GPG-sign the commits made by @JuliaRegistrator and @jlbuild

[DilumAluthge]

Since so many users rely on the General registry, it would be nice to increase the level of security.

I don't think that it is feasible to ask all users that make manual PRs to General to GPG-sign their commits.

I do think, however, that is it reasonable for the two main bot users that generate automated PRs to General (@JuliaRegistrator and @jlbuild) to GPG-sign their automatically generated commits.

Related issues:

• Automatically GPG-sign the commits made by @JuliaRegistrator Registrator.jl#273
• Automatically GPG-sign the commits made by @jlbuild JuliaPackaging/Yggdrasil#635

[DilumAluthge]

We have taken the following two steps:

1. Configure AutoMerge to always use squash-merge
2. In the GitHub repo settings for this repo, disable the "merge" and "rebase and merge" options for merging. The only option for merging is squash-merge.

As a result, the commits on a General are now GPG-signed by GitHub's web flow GPG key. See for example the following screenshot:

So this is resolved.