wip - verify autograph-stage mar signatures

[escapewindow]

Assuming this approach is ok, I plan to:

• add the autograph-stage mar pubkey in-tree
• add the autograph-stage mar pubkey in mardor, to allow for signature verification (this PR)
• add the autograph-stage creds to the dep signing passwords file
• add the capability to verify mar signatures, via mardor, in signingscript. This could be optional or on by default.
• add a nightly task [that doesn't run by default] that signs a mar through depsigning scriptworkers->autograph-stage, and verifies it through mardor, and turns green if successful
  • the plan is for anyone with the right scopes to be able to add task this task against the most recent nightly graph, and check its status.

[codecov-io]

Codecov Report

Merging #49 into master will increase coverage by <.01%.
The diff coverage is 100%.

@@            Coverage Diff             @@
##           master      #49      +/-   ##
==========================================
+ Coverage   98.57%   98.57%   +<.01%     
==========================================
  Files           8        8              
  Lines         701      702       +1     
  Branches      125      125              
==========================================
+ Hits          691      692       +1     
  Misses          2        2              
  Partials        8        8

Impacted Files	Coverage Δ
src/mardor/cli.py	98.34% <ø> (ø)	⬆️
src/mardor/mozilla.py	100% <100%> (ø)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2ce36be...61fdc08. Read the comment docs.

[escapewindow]

We need to change this to autograph_stage.pem, and possibly write a new get_pem_key helper function to not expect a der format file.