Provider Signature Verification on Upload

Add server-side GPG signature verification when providers are uploaded to Spacelift's registry. Currently, Spacelift accepts providers even if the signature file is corrupted. Validating the signature on upload would catch corruption regardless of whether it happened on the client side or in transit, preventing broken providers from ever being published.