GHSA-7c37-gx6w-8vc5: gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers

gitsign's certificate verification code crashes with a panic when it receives a signature with no certificates (which is valid according to the CMS/PKCS7 standard), and the panic is silently caught and converted to exit code 0, making failed verification look successful to scripts and CI systems that only check the exit code.