ROX-34488: verify sigstore bundle signatures via sigstore-go

Add verifySigstoreBundle which verifies DSSE-envelope signatures using
sigstore-go directly, bypassing the cosign SimpleSigning path. The
verifier now branches on signature format: SimpleSigning signatures
continue through cosign.VerifyImageSignature, while sigstore bundles
use sigstore-go's verify.SignedEntity with the same trust roots
(public key or certificate identity/issuer).

Partially generated by AI.

Author: stehessel

pkg/signatures/cosign_sig_fetcher_test.go

@@ -203,6 +203,7 @@ func TestCosignSignatureFetcher_FetchSignature_Success(t *testing.T) {
 				Cosign: &storage.CosignSignature{
 					RawSignature:     rawSig1,
 					SignaturePayload: sigPayload1,
+					SignatureFormat:  storage.CosignSignature_SIMPLE_SIGNING,
 				},
 			},
 		},
@@ -211,6 +212,7 @@ func TestCosignSignatureFetcher_FetchSignature_Success(t *testing.T) {
 				Cosign: &storage.CosignSignature{
 					RawSignature:     rawSig2,
 					SignaturePayload: sigPayload2,
+					SignatureFormat:  storage.CosignSignature_SIMPLE_SIGNING,
 				},
 			},
 		},
@@ -221,6 +223,7 @@ func TestCosignSignatureFetcher_FetchSignature_Success(t *testing.T) {
 					SignaturePayload: sigPayload3,
 					CertPem:          certPEM,
 					CertChainPem:     chainPEM,
+					SignatureFormat:  storage.CosignSignature_SIMPLE_SIGNING,
 				},
 			},
 		},
@@ -232,6 +235,7 @@ func TestCosignSignatureFetcher_FetchSignature_Success(t *testing.T) {
 					CertPem:          certPEMWithTlog,
 					CertChainPem:     chainPEMWithTlog,
 					RekorBundle:      bundle,
+					SignatureFormat:  storage.CosignSignature_SIMPLE_SIGNING,
 				},
 			},
 		},
@@ -622,6 +626,7 @@ func TestCosignSignatureFetcher_FetchSignature_WithCredentials(t *testing.T) {
 				Cosign: &storage.CosignSignature{
 					RawSignature:     rawSig1,
 					SignaturePayload: sigPayload1,
+					SignatureFormat:  storage.CosignSignature_SIMPLE_SIGNING,
 				},
 			},
 		},