feat: Add OCI 1.1+ experimental support to tree

[ralphbean]

Summary

Adds OCI 1.1 Referrers support to cosign tree.

Resolves #4204.

Example usage:

❯ ./cosign tree --experimental-oci11 quay.io/rbean/tree-scsa:example
📦 Supply Chain Security Related artifacts for an image: quay.io/rbean/tree-scsa:example
└── 🔐 Signatures for an image tag: quay.io/rbean/tree-scsa:sha256-b3454025ce78fa93aba879b2824a06a59e2b8c5005b2a4286368433cd0f41cde.sig
   └── 🍒 sha256:ef4e39921eeb670ea453be070877d0fef225a13f97a9f9bf107d4d04d4c0dba6
└── 💾 Attestations for an image tag: quay.io/rbean/tree-scsa:sha256-b3454025ce78fa93aba879b2824a06a59e2b8c5005b2a4286368433cd0f41cde.att
   ├── 🍒 sha256:105da535ba7425024b03685048c33a458b3147315458fc1291479bae34f34997
   └── 🍒 sha256:98c6b2784ffe8a38cc4533d9a5d845cfe4ce72c2aa7e7f00a0682718d0259472
└── 🔗 application/vnd.dev.sigstore.bundle.v0.3+json artifacts via OCI referrer: quay.io/rbean/tree-scsa@sha256:01ca3469ae921632f7bd965cb34f9c10f07a723ea68223008871e86052bcfec8
   └── 🍒 sha256:a336d1bfe93e60ae8a5cbbe546663517719d8f3ce1e628ffc0196c0cdf658314

Release Note

• Updated cosign tree to additionally display artifacts found via the OCI 1.1 Referrers API when --experimental-oci11 is specified.

Documentation

IMO, no docs needed beyond make docgen.

[bobcallaway]

thanks for the PR; i'll try to take a detailed look today.

[codecov]

Codecov Report

Attention: Patch coverage is 0% with 46 lines in your changes missing coverage. Please review.

Project coverage is 34.26%. Comparing base (2ef6022) to head (a2c8e13).
Report is 434 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/cosign/cli/tree.go	0.00%	42 Missing ⚠️
cmd/cosign/cli/options/tree.go	0.00%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4205      +/-   ##
==========================================
- Coverage   40.10%   34.26%   -5.84%     
==========================================
  Files         155      211      +56     
  Lines       10044    14127    +4083     
==========================================
+ Hits         4028     4841     +813     
- Misses       5530     8672    +3142     
- Partials      486      614     +128     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ralphbean]

Fixed golangci-lint issue.

[bobcallaway]

thanks!