Integrate Sigstore for "keyless signing" of packages and their build provenence about zarf HOT 1 OPEN

To implement keyless signing verification zarf will need to provide more options than it's current --key to verify signatures.
To support verifying signatures using the built-in default sigstore Public-Good Instance CA roots, an equivalent to Coign's --certificate-oidc and --predicate-type is required at a minimum, but Cosign has many other certificate matching options we may want too. If we want to support self hosted Sigstore we would need to allow configuring the Fulcio roots, I think Cosign supports this by configuring the SIGSTORE_ROOT_FILE environment variable (I think there's a way to do it through TUF too).

Please ensure these options are exposed in the go api so that external tools integrating Zarf can use them.

from zarf.