feat: add --sign flag to sign git commit and tag

[nexdrew]

Builds on top of (and replaces) #18, with the following additions:

• Sign the commit as well as the tag
• Change the CLI option to --sign (instead of --sign-tag) and update the description
• Add a test that verifies GPG signing was attempted by git (and failed from lack of key)

[bcoe]

@nexdrew if you get two seconds, mind rebasing this and we'll land it; if you don't get to it I can create a branch for merging later tonight.

[nexdrew]

@bcoe Working on it

[coveralls]

Coverage increased (+1.7%) to 91.566% when pulling de84720 on nexdrew:signing into 3f51e94 on conventional-changelog:master.

[nexdrew]

@bcoe Rebased. I was wondering why coverage showed 100% when my --sign test never makes it to the git tag -s call. :P

[addaleax]

@nexdrew See the shelljs issue @bcoe linked above – I’ll be posting an explanation there shortly :)

[bcoe]

@nexdrew thanks for rebasing. @addaleax great find, hopefully we can get that upstreamed this week.

[nexdrew]

Perhaps mocking the git bin just for the --sign test would be a better alternative to expecting a failure on the commit (which preempts the tag)?