improve error messages around bundle != payload hash

[imjasonh]

Before this change, when the bundle hash doesn't match the payload hash, the error message is error verifying bundle: matching bundle to payload: %!w(<nil>) which isn't terribly helpful.

This hopes to improve the error experience in this area, by:

• clearly failing ASAP when bundle hash computation fails
• clearly failing separately if the bundle algorithm is somehow not sha256
• clearly failing with both hashes when they don't match, hopefully making debugging easier

[hectorj2f]

lgtm, thanks @imjasonh

[codecov]

Codecov Report

Merging #3146 (059e570) into main (af555d5) will decrease coverage by 0.54%.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##             main    #3146      +/-   ##
==========================================
- Coverage   30.56%   30.03%   -0.54%     
==========================================
  Files         155      155              
  Lines        9801     9806       +5     
==========================================
- Hits         2996     2945      -51     
- Misses       6359     6432      +73     
+ Partials      446      429      -17     

Files Changed	Coverage Δ
pkg/cosign/verify.go	35.25% <0.00%> (-0.19%)	⬇️

... and 4 files with indirect coverage changes

[imjasonh]

https://github.com/sigstore/cosign/actions/runs/5716646806/job/15489553850?pr=3146

google.golang.org/grpc/internal/googlecloud: mkdir /tmp/go-build89590620/b1593/: no space left on device

I think I need an adult to retry to workflow.

[haydentherapper]

(Ignore if you've never seen Bojack Horseman)