Pass flags to gpp down through debsign to use agent

In the promotion workflow, we need to be able to tell debsign to use gpg but
without the default search for a tty. This is because jenkins doesn't give us a
tty. Debsign accepts an alternate program to use for signing via -p. We take
advantage of this to pass gpg along with our flags to debsign.

We also switch to "sh" instead of %x on the call to ensure failures raise
exceptions.

Signed-off-by: Moses Mendoza <moses@puppetlabs.com>