Only set LRO_GPGCHECK when repo_gpgcheck=1

librepo doesn't actually check the signatures of downloaded packages.
Do not use a global keyring for checking metadata

Yum uses a per-repo check, so we should probably do the same.
Never allow installing an unsigned package in a repo with gpgcheck=1

Even with the HIF_TRANSACTION_FLAG_ONLY_TRUSTED authentication (usually root)
this is a bad idea. A source is either trusted or untrusted, and users are
just blindly enter a password without checking the problem.

Also deny for all users any package that does not match the MD5 or SHA1 internal
checks or has an unreadble digest header.
trivial: Add hif_realpath

We need this for future code.
trivial: Add hif_remove_recursive()
Add HIF_SOURCE_UPDATE_FLAG_SIMULATE

This will be useful for adding self-tests.
Allow testdatadir in repo files

This local extension makes it possible to add a self-test framework.
Correctly update sources with baseurls ending with a slash
Support appstream and appstream-icons metadata types
Add a large number of GPG tests

For those curious enough to regenerate the files, the passphrase on the secret
keyring is 'libhif'.