make package gpg checks configurable and set default to true

The zypper package provider should check the gpg signature of packages by default. Doing otherwise is a security hazard. This should be configurable.