Replace gnupg with sequoia

[jschlatow]

We'd like to switch to using sequoia pgp for creating and verifying archive signatures at some point in the future (i.e. once the CLI of sq is settled). In the scope of the #99 overhaul, I experimented with replacing using sq in the depot tool.

Basically, replacing gpg with sq is pretty straightforward. I particularly like the clarity of the CLI. Nevertheless, I had a bit of trouble with signing. Apparently, sq requires write access to the user's key store. In a sandboxed execution environment, however, I don't want to make the entire key store available with write access. Moreover, there seems to be no general caching mechanism for passwords (yet), so that a user would need to unlock the secret key for every to-be-signed archive. I found a workaround that consists in exporting the secret keys known from the used depot directory from sequoia's keystore and making it available in unencrypted form in the sandbox. Bubblewrap has the nifty feature of being able to bind mount a file that is initialised by copying from a file descriptor. The downside is that, using this feature, bubblewrap cannot be executed directly from tcl anymore because we need input redirection to arbitrary file descriptors as provided by bash.