feat: direct verification of bundle with sigstore-go

[brandtkeller]

Description

With the removal of producing any legacy signatures and only defaulting to the sigstore bundle format we can now begin looking at migrating from the use of Cosign to Sigstore.

We still require the existing Cosign logic for legacy signatures - which we've been preserving for the ability to perform verification of older packages without the bundle format - yet we can begin integrating new sigstore functionality that can eventually allow us to deprecate and remove the cosign logic.

A full migration spike is still underway - but verification itself is more isolated and less complex than the requirements for signing.

This PR add direct sigstore bundle verification with parity to Cosign for supported options and as such it no longer emits the Verified OK message to stderr upon verification.

Moving the blank KMS provider imports to a neutral location such that they are not inadvertently lost between any future migration work as this sigstore implementation does rely on them for parity.

Adds some additional testing and highlights some features that we don't tend to broadcast (such as public key retrieval from an environment variable or kubernetes.

Related Issue

Fixes #5172

Relates to #

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide Steps followed

[netlify]

✅ Deploy Preview for zarf-docs canceled.

Name	Link
🔨 Latest commit	b2e154a
🔍 Latest deploy log	https://app.netlify.com/projects/zarf-docs/deploys/6a762788c533d600089cdfd1

[codecov]

Codecov Report

❌ Patch coverage is 55.67376% with 125 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/pkg/signing/sigstore.go	55.19%	88 Missing and 37 partials ⚠️

Files with missing lines	Coverage Δ
src/pkg/packager/layout/package.go	70.56% <100.00%> (+0.05%)	⬆️
src/pkg/signing/cosign.go	76.88% <ø> (-1.08%)	⬇️
src/pkg/signing/sigstore.go	55.19% <55.19%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[brandtkeller]

Not exposed by the CLI but potentially supported by the SDK given the broader VerfiyBlobOptions.