Return false instead of panicking in PublicKey::verify_signature

[faern]

As discussed AFK. We do not want panics. The reference sigsum-go just return false in this case also.

I do not think the changelog for the 0.2.0 version is complete? It does for example not mention the public constant built in policies. But that's unrelated to this PR and should not be fixed here. I just went ahead and added the changelog header, to be able to separate this change from the ones in the previous release.

This is related to #15

[gregoire-mullvad]

Thanks!

Re. CHANGELOG, it looks like I forgot to push the release commit (the one that the v0.2.0 tag points to). Should be fixed now (so that v0.2.0 is actually reachable from main). Could you rebase this on top?

I may have misunderstood your comment, but the changelog does mention the built-in policies:

• The crates now ships with the sigsum-generic-2025-1 policy as well as three
  test policies (same policies that are built into the reference Sigsum tooling).

[faern]

I may have misunderstood your comment, but the changelog does mention the built-in policies

You are right. Misunderstanding on my part. I thought version 0.1.0 had the policies, but just not the statics that I added in #12. But since none of that was part of 0.1.0 it's not a change between the versions.