[FEATURE REQUEST] User-defined installer trust criteria to protect against supply chain attacks

This is basically an implementation of a feature idea I had for WinGet itself, but I realized it could also be implemented in UniGet. That proposal is written in more detail here: https://github.com/microsoft/winget-pkgs/issues/118508
But the feature idea below is leaner and simpler.

-----------

### Please confirm these before moving forward.

- [x] I have searched for my feature proposal and have not found a work-in-progress/duplicate/resolved/discarded issue.
- [x] This proposal is a completely new feature. If you want to suggest an improvement or an enhancement, please use [this template](https://github.com/Devolutions/UniGetUI/issues/new?labels=enhancement&projects=&template=enhancement-improvement.yml&title=%5BENHANCEMENT%5D+%28Enter+your+description+here%29).

### Describe the new feature

**Problem:**
When doing `winget upgrade` , how do I know that any given app's installer that gets downloaded is the real deal? And that the manifest that got added to the WinGet repo doesn't point to some imposter site, and had slipped through the cracks because it didn't trigger the antivirus scans or the manual approval stage?

**Idea:**
On a per-app basis, allow the user to create a sort of "trust list" with "expected properties" about the app, and ensure the manifest matches that before downloading or installing.

**Examples:**
* Only download an update for Firefox if the installer download url in the manifest has the domain `mozilla.org`.
* Only run the installer exe for GitHub desktop if its signature certificate thumprint is `af2b83bac53d9...`
* Only run an installer if _either_ the signature or url matches
* Only run the installer if _both_ the signature and url match

### Describe how this new feature could help users

For the most critical apps like password managers, and apps likely to be highly targeted like wallets, it would add a layer of protection against supply chain attacks at the winget repo level.

An inherent benefit is that the same trust criteria could apply regardless of which package manager you're using