fix: npm audit signatures for keyless attestation registries

[ajayk]

npm audit signatures fails when a registry only uses keyless (Sigstore/Fulcio) attestations and doesn't provide registry signing keys. The auditedWithKeysCount guard in verify-signatures.js treats any registry without keys as unsupported, even though keyless attestations don't need registry keys at all -- the signing certificate is embedded directly in the bundle and verified through Sigstore's TUF root of trust.

This updates the check to also accept verified keyless attestations as a valid audit result, so registries that exclusively use Fulcio-based signing (like Chainguard) work correctly with npm audit signatures.

Before this change:
npm error found no dependencies to audit that were installed from a supported registry

After:
audited 1 package in 1s

1 package has a verified attestation

This change works together with the corresponding pacote fixes (pacote/pull/454)
(pacote/pull/452)
which allows keyless attestation bundles to pass the registry key matching check.

[wraithgar]

We tend not to accept PRs that update dependencies. We have a dependency updates PR in flight now #9027

[ajayk]

We tend not to accept PRs that update dependencies. We have a dependency updates PR in flight now #9027

Thanks I will rebase it once it merges

[ajayk]

@wraithgar rebased and for your review