Improve handling of tlog interaction when --upload=false

[sabre1041]

Currently, when COSIGN_EXPERIMENTAL=1 is set, content is always published to rekor. However, when --upload=false, it should be possible to not only support storing image signatures and certificates locally, but the necessary details to avoid needing to communicate with rekor.

Assumptions:

• COSIGN_EXPERIMENTAL=1 set

Discussion:

• Support is needed to avoid uploading to tlog when --upload=false is set
• Verification always assumes that content is stored in the tlog. Verification will fail if content is not available.
• sign-blob contains the functionality to store a bundle to disk through the --bundle flag. Feature should also be implemented in sign. When verifying, bundle can either be provided from disk or from rekor to avoid communication if needed

[znewman01]

This should be fixed via a combination of:

• Feat: option for online tlog verification of containers/blobs #2320
• Cases for verification for cosign 2.0 #2466
• FR: offline mode #2255