feat: support cosign signatures in OCI-SIF files

[dtrudg]

Add support for cosign signatures / attestations associated with images and indexes within OCI-SIF files.

Storage within the OCI-SIF

A cosign signature or attestation is an OCI image. It is associated with the image or index it targets using a tag based approach. The signature or attestation has a tag indicating the digest of its target.

Within an OCI-SIF file, we will store cosign signatures and annotations so that they have a org.opencontainers.image.ref.name annotation in the root index, where the ref.name is a placeholder _cosign
repository followed by the standard cosign tag, e.g.:

_cosign:sha256-432f982638b3aefab73cc58ab28f5c16e96fdb504e8c134fc58dff4bae8bf338.sig

SourceSink

The cosign module defines SignedImage and SignedImageIndex types, which wrap the standard ggcr image / index types. Because signatures / attestations are seperate images, associated with their target by tag, a SignedImage orSignedImageIndex needs to be able to access blobs outside of the scope of the wrapped image or index, to 'see' the
signatures / attestations.

This PR introduces a SIF SourceSink, which is both a Source and a Sink. A Source implements Get() to return a Descriptor that can provide an Image or an Index, depending on the content of the layout and the options that Get() was called with.

A Descriptor can be upgraded to a SignedDescriptor, which provides access to raw cosign signature/attestation images, as well as cosign.SignedImage/SignedImageIndex types.

A Sink implements Write(), accepting a Writable which is either a v1.Image or v1.Index. Options allow the image or index to have a name.ref annotation set in the root index when it is written.

Note that at this point, cosign signature / attestation images must be explicilty written into the SIF. Write does not automatically write associated signatures / attestations if passed a SignedImage.