ci: Add linter to make sure all commits are DCO signed

Mentioned in the CONTRIBUTING.md as well.
Let's enforce it.

Signed-off-by: Michael Vetter <jubalh@iodoru.org>

.github/workflows/commit-lint.yml

@@ -1,17 +1,34 @@
-name: "Commits"
+name: "Lint"
 
 on:
   pull_request:
     branches: [master]
+    types: [opened, synchronize, reopened]
 
 jobs:
-  lint:
+  commitlint:
+    name: "Conventional Commits"
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
-          # Applies to all commits
+          # Fetch all history so commitlint can see the commits in the PR
           fetch-depth: 0
 
       - name: "Conventional Commits"
         uses: wagoid/commitlint-github-action@v6
+
+  dco:
+    name: "DCO"
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Get PR Commits"
+        id: "get-pr-commits"
+        uses: tim-actions/get-pr-commits@v1.3.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: "Check DCO"
+        uses: tim-actions/dco@v1.1.0
+        with:
+          commits: ${{ steps.get-pr-commits.outputs.commits }}