GHSA-7rmh-48mx-2vwc: gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits

gitsign verify has a signature verification flaw where it re-encodes commit objects through go-git before checking signatures, instead of verifying the raw git object bytes. When a malformed commit has duplicate tree headers, git-core and go-git parse them differently (git-core uses the first tree, go-git uses the second), allowing an attacker to craft a signature that passes gitsign verify but refers to a completely different commit than what git-core would show to users, breaking the trust model.