dgit-repos-server for tag2upload needs refactoring to verify the tag sooner

We need to make sure that we're verifying the tag as early as the design says, as this was one of the security review's recommended changes. It'll be a bit of refactoring work, so filing this issue, rather than entangling it with my current work towards tag2upload-service-manager#2 (closed).

Specifically, the following should happen, in this order:

1. verify key is signed by someone in keyring and it uses a good enough hash function
2. parse the tag for metadata
3. check signer is authorised for the package.