RFE: Add opt-in metadata signature verification.

[Jeff Johnson]

RPM 5.3 has dropped signature verification on headers retrieved
from an rpmdb because
    1) there's no known benefit or increase in security
    2) there's a performance penalty which -- while not large -- doesn't meet
    luser expectations.

Verifying the signature on the header metadata blob needs to be resurrected as
"opt-in" functionality with --verify, and (for extra credit) performed on a separate thread.

[Jeff Johnson (n3npq)]

Verifying header signatures was add to --verify a while ago.
The operation is also multi-threaded using -fopenmp as well.