pmg: optionally verify cvd files with sigtool

pmg: optionally verify cvd files with sigtool

sigtool (1)  is clamav's utility to manipulate and verify cvd files.
It is shipped in the clamav package, which is not installed inside
pmg (pmg uses the daemonized version - clamav-daemon).

This patch verifies the downloaded cvd-files if sigtool is installed on the
build host and skips the verification if not (in order to not depend on an
installed clamav package).

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>