Use sqv to verify signatures in install-mullvad instead of gpg

[faern]

sqv is more modern and secure (gpg.fail). It's a more purpose built and simple tool for just verifying PGP signatures and nothing else. We have already started using it in other places so this is nothing new. I just wanted to move towards using GnuPG even less.

Here I use --signature-file instead of just passing the signature + data as two positional arguments. I do this because of this section of the sqv man page:

Finally, there is a legacy way to verify detached signatures, where the path to the signature file and the path to the data file are given as positional arguments. This form is deprecated, prefer the explicit --signature-file form.

https://www.mankier.com/1/sqv

---

This change is