fix: update sha1 to sha256 and other chores

[priteshbandi]

Fixes: #611 and #635

[codecov-commenter]

Codecov Report

Merging #665 (fdb0d31) into main (5516199) will decrease coverage by 0.04%.
The diff coverage is 0.00%.

❗ Your organization is not using the GitHub App Integration. As a result you may experience degraded service beginning May 15th. Please install the Github App Integration for your organization. Read more.

@@            Coverage Diff             @@
##             main     #665      +/-   ##
==========================================
- Coverage   33.33%   33.30%   -0.04%     
==========================================
  Files          32       32              
  Lines        2019     2021       +2     
==========================================
  Hits          673      673              
- Misses       1324     1326       +2     
  Partials       22       22              

Impacted Files	Coverage Δ
cmd/notation/inspect.go	14.21% <0.00%> (-0.15%)	⬇️
cmd/notation/internal/truststore/truststore.go	10.60% <0.00%> (ø)

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[Two-Hearts]

By searching Sha1 in Notation CLI, I found we are also showing Sha1 in the notation cert show command:

notation/cmd/notation/internal/truststore/truststore.go

Line 124 in 5516199

h := sha1.Sum(cert.Raw)

Should we also change it to Sha2 in this PR?

[Two-Hearts]

LGTM

[shizhMSFT]

LGTM

[rgnote]

LGTM