[CI] Run a local rekor instead of depending on availability of public service

[apostasie]

What is the problem you're trying to solve

Title says all (rekor has been failing the CI a lot lately).

Generally speaking, we should not test against public infrastructure whatsoever.

Describe the solution you'd like

Run a rekor instance and use that instead.

Additional context

No response