Add sigstore bundle verification

[mnsboev]

• All tests passed. If this feature is not already covered by the tests, I added new tests.
• All static analysis checks passed.
• Appropriate label is added to auto generate release notes.
• I used gofmt for formatting the code before submitting the pull request.
• PR description is clear and concise, and it includes the proposed solution/fix.

---

Description:
Sigstore Bundle verification support is added.

Example of call:
jf evd verify --subject-repo-path cli-sigstore-test/commons-1.0.0.txt

Example of output:
Subject sha256: 434728a410a78f56fc1b5899c3593436e61ab0c731e9072d95e96db290205e53
Subject: cli-sigstore-test/commons-1.0.0.txt
Loaded 18 evidence

Verification passed for 18 out of 18 evidence

• Evidence 1:
  • Media type: sigstore.bundle
  • Predicate type: in-toto
  • Evidence subject sha256: 434728a410a78f56fc1b5899c3593436e61ab0c731e9072d95e96db290205e53
  • Key source: Sigstore Bundle Key
  • Sha256 verification status: success
  • Signatures verification status: success
  • Timestamp verification status: success
    ...

[alenon]

support cosign generated Sigstore Bundles (Statement v0.1)