Add high-level APIs to sign and verify Python artifacts

[facutuesca]

Adds a way to sign and verify Python artifacts, as methods of the existing AttestationPayload and Attestation classes:

class AttestationPayload(BaseModel):
    def sign(self, signer: Signer) -> Attestation:
        ...

class Attestation(BaseModel):
    def verify(self, verifier: Verifier, policy: VerificationPolicy, dist: Path) -> None:
        ...

See the new additions to the README for how they would be used in practice.
The tests added use stubs for sigstore.Signer and sigstore.Verifier: we only care if they are called with the expected arguments.

I also updated the test assets so that the .bundle and .attestation files were actually generated by signing an AttestationPayload (as opposed to signing the artifact itself)

[woodruffw]

Is this correct? I think InvalidAttestationError isn't a type in sigstore-python

[facutuesca]

True, the docstring is wrong here. Do we want to wrap sigstore's VerificationError with our own exception class, or just use sigstore's?

[woodruffw]

Hmm, I suppose we should have it be our own -- wrapping makes sense to me 🙂

[facutuesca]

fixed!

[woodruffw]

LGTM, one question!