GPG signature must match the committer in order to be verified

Merged Alexis Reigel requested to merge siemens/gitlab-ce:feature/gpg-verification-status into master

What does this MR do?

It adds an additional check to make sure that the signature and the commit were created by the same user.

Are there points in the code the reviewer needs to double check?

Why was this MR needed?

Currently the committer and the signature don't have to be created by the same user, which is confusing and may lead to a wrong conclusion about the authenticity of the signature.

The development of this MR is sponsored by @siemens (/cc @bufferoverflow).

Screenshots (if relevant)

Does this MR meet the acceptance criteria?

What are the relevant issue numbers?

Edited by Alexis Reigel