Request: gpg sign all commits

[rbarker-dev]

I noticed that the yq project isn't requiring commits to be signed from internal or external contributors. I would recommend enforcing gpg signing on all commits so that the consumers of the project can visually verify that commits can be trusted.

I believe there's a repository level setting under the General tab
Require contributors to sign off on web-based commits which can be checked.