common: Prevent pulling ostree-metadata unless gpg-verify is true
common: Prevent pulling ostree-metadata unless gpg-verify is true

Add a sanity check and error message which prevents pulling the
ostree-metadata ref (the repository metadata) unless GPG verification is
enabled, as it needs to be signed to be trusted.

Signed-off-by: Philip Withnall <29c2a2ac2a854b9cf047275aa9de346d096be2e0@endlessm.com>

matthiasclasen/flatpak,handsome-feng/flatpak,flatpak/flatpak,flatpak/flatpak,handsome-feng/flatpak,handsome-feng/flatpak,matthiasclasen/flatpak,flatpak/flatpak,handsome-feng/flatpak,flatpak/flatpak,matthiasclasen/flatpak,matthiasclasen/flatpak,flatpak/flatpak,handsome-feng/flatpak,matthiasclasen/flatpak