During release promotion, we want to verify the tag is signed with one
of the releasers' key. The commit can be signed with a different
signature (e.g. the bot's, or a soon-to-be releaser).

Partially fixes: nodejs-private/security-release#48

Fixes: nodejs-private/security-release#48

This reverts commit 6cc2b1a.

Changes have been made on Jenkins side, tip of the PR head must be sent
to Jenkins in order to start a PR. This commit adapts ncu-ci CLI to pass
that information – or get the SHA from the latest review if not passed.

...to display commits pushed since last approving review. It would only
matter if time on the comitter machine is very different from GitHub's
own time.
That allows us to skip quering for `timelineItems`.

In `git node release --prepare` when checking out a new proposal branch
make sure it's also possible to update an already existing branch of
that same name instead of failing and terminating the automation.