Sign gems release tags with gpg

As suggested in #2388 by @indirect, implemented gem_helper.sign_tags config option, to sign gem release tags.

Where I'am not sure:

1. Added gpg key to spec/fixtures, maybe there are better places?

2. Added which method to Spec::Path for cross-platform check for files in $PATH. It used to  exclude gpg specs on machines without gpg installed.

3. ENV['BUNDLE_GEM_HELPER__SIGN_TAGS'] in specs not ``` bundle "config gem_helper.sign_tags true" ``` as suggested by @indirect because config read once on Bundler::Settings and can't be reloaded, and so I can't manipulate with settings values during spec run.

Thanks.