Trivial PGP signing of crates

Instead of endlessly discussing various trust models etc, just implement a simple scheme:

```toml
[package.metadata.simplesign]
key = "HEX_PGP_KEY"
```

Add `.signature` file to the project which is inline signed SHA256SUMs of all non-hidden files.
Add `cargo sisi` command which will fetch and check all crates using TOFU model.
`cargo sisi sign` can be used to sign the current state of directory.
`cargo sisi assign PACKAGE FINGERPRINT` - for paranoid users who want to add the record before pulling it first time

Much better than nothing and we can then figure out better solutions.

Start with the requested [package.metadata.simplesign] configuration and the cargo sisi entry points. Define completion around producing an inline-signed .signature for SHA256SUMs of non-hidden files, checking crates with TOFU, and supporting the sign and assign commands.

Written by the indexing model from the issue text.