we need the commit object for the updated verification that also checks
the committer's email to match the gpg key and user's emails.

Add 'from commit' information to cherry-picked commits

See merge request !13475

Also improved the UT for better documenting this change.

The list of commits must be generated from the merge request,
not from a diff of the branches.

Only create commit GPG signature when necessary

See merge request !13561

Follow the `cherry pick -x` format for the first line, and the
interactive rebase format for the commits in the merge, in case
of merge commit