recover: add a --[no-]verify flag
For trivial cases, the cost of the verify run after hg recover is getting in
the way. In addition for very large repositories, the cost is simply too high
to be paid, making hg recover an unusable commands.
We introduce a --verify flag, set by default. If is automatically associated
with a --no-verify flag that one can use to skip the verify step.
We might consider changing the default behavior in the future. However this is
out of scope for this series.