Add support for new bundle specification in cosign verify-attestation

[codysoyland]

This PR adds support for the new Cosign Bundle Specification in cosign verify-attestation.

This works in conjunction with #3888 and is interoperable with GitHub Artifact Attestations.

Related: #3139

This is in draft for now pending:

• TSA Support
• Wiring in verification options from CheckOpts
• More metadata returned in oci.Signature (currently outputs just enough to display basic verification success message)
• Error propagation similar to that in VerifyImageAttestation
• Tests

To test, run the following (replacing MY_IDENTITY, MY_ISSUER, MY_TRUSTED_ROOT and MY_IMAGE as needed):

go run ./cmd/cosign verify-attestation --certificate-identity MY_IDENTITY --certificate-oidc-issuer MY_ISSUER --expect-sigstore-bundle=true --trusted-root=MY_TRUSTED_ROOT MY_IMAGE

Summary

Release Note

Documentation

[codecov]

Codecov Report

Attention: Patch coverage is 1.68067% with 351 lines in your changes missing coverage. Please review.

Project coverage is 35.55%. Comparing base (2ef6022) to head (8796901).
Report is 236 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/cosign/verify.go	0.00%	131 Missing ⚠️
pkg/oci/remote/write.go	0.00%	89 Missing ⚠️
cmd/cosign/cli/verify/verify_attestation.go	0.00%	36 Missing ⚠️
cmd/cosign/cli/attest/attest.go	0.00%	32 Missing ⚠️
pkg/oci/remote/signatures.go	0.00%	20 Missing ⚠️
cmd/cosign/cli/attest/common.go	0.00%	10 Missing ⚠️
pkg/cosign/verify_bundle.go	0.00%	10 Missing ⚠️
cmd/cosign/cli/verify/verify.go	0.00%	8 Missing ⚠️
cmd/cosign/cli/attest/attest_blob.go	14.28%	6 Missing ⚠️
cmd/cosign/cli/verify.go	0.00%	3 Missing ⚠️
... and 4 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3889      +/-   ##
==========================================
- Coverage   40.10%   35.55%   -4.55%     
==========================================
  Files         155      210      +55     
  Lines       10044    13693    +3649     
==========================================
+ Hits         4028     4869     +841     
- Misses       5530     8198    +2668     
- Partials      486      626     +140     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.