Add support to verify GPG signatures for git modules (git.latest, git.cloned) #56900

Is your feature request related to a problem? Please describe.

When using git.latest I require an option to verify the GPG signature of a commit before continuing.

Describe the solution you'd like

An option like verify that uses --verify-signatures when doing git pull.

Describe alternatives you've considered

I've tried using git.config_set to deploy this to ~/.gitconfig:

[pull]
  verifySignatures = true

Unfortunately git.latest doesn't seem to respect the options in .gitconfig.

Additional context

Maybe a generic option for the opts parameter in def pull() would also suffice, where one can manually set --verify-signatures.