Use `gpg.program` in Git config

Currently, use of `gpg` is [hardcoded](https://github.com/google/git-appraise/blob/98c8fb2f1cf2716d4d63b59c0a5edc44c54c4dd3/review/gpg/signable.go#L65). Instead, it ought to check whether a user has the config key `gpg.program` set, and use it if so. If not, it can fall back on a default.