MSI: implement -require-leaf-hash for CMD_VERIFY.