gpg: --compliance=rfc2440 does not require cross-certification

* g10/gpg.c (set_compliance_option): clear
opt.flags.require_cross_cert with oRFC2440

This aligns with the expectations in RFC 2440, which doesn't specify
any cross-certifications. As doc/gpg.texi says: "This is dangerous",
but it aligns with the specification.

The comment above says that 4880 is the same as 2440, "but with [...]
--require-cross-certification", so we align the code with the intent
from the comment. It looks like opt.require_cross_cert was turned on
by default after that comment (and the oRFC2440 section) was written,
but the oRFC2440 section was never updated to turn it off.

• Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>