write-repo-file: add --gpg-key option
    
    Prior to this change, compose-write-repo-file unconditionally wrote
    .repo files with "gpgcheck = 0".
    
    Add a new --gpg-key option to compose-write-repo-file. When a user
    specifies a comma-separated key ID and key URL, we sanity-check that
    every every RPM is signed by this key. For each variant with signed
    RPMs, we set the "gpgcheck = 1" and "gpgkey" options in the .repo file.