Add flag for manually specifying a hash algo when verifying

[SgtCoDFish]

Summary

While, at the time of writing, it's not possible to manually specify the signature digest algorithm which should be used when signing an image, some KMS providers have key types which force a digest algorithm which isn't sha256; e.g. GCP KMS with RSA4096 / SHA512 keys.

Cosign will happily use these keys for signing and will infer the digest algorithm based on what the KMS provider mandates, leading to a situation where cosign generates signatures which it can't later verify.

This commit adds a new --signature-digest-algorithm flag which allows the user to manually specify one of 4 commonly-used secure hashes when using cosign verify.

Notes

1. Normally I'd (of course) add an e2e test for this kind of thing, but I can't see an obvious way of generating, say, a SHA512 signature without using a cloud KMS currently, and unless I'm missing something it doesn't look trivial to add that. I think adding an e2e test would require adding --signature-digest-algorithm to cosign sign, which I think would be desirable but is a much bigger piece of work and maybe needs more discussion.
2. I'm not totally sold on --signature-digest-algorithm as a flag name - it's a bit wordy. Happy to rename if someone has a better suggestion!

Testing

I've tested that this works correctly using a test image which I think should be publicly available. Using this commit, I can successfully run:

curl -sSL https://raw.githubusercontent.com/SgtCoDFish/ace/main/PUBKEY > /tmp/PUBKEY
$ ./cosign verify --key "/tmp/PUBKEY" --signature-digest-algorithm SHA512 ghcr.io/sgtcodfish/ace:0.5

Ticket Link

Related to #946, specifically this comment. That issue is more broad, though, and there's probably more work to be done in the future for that issue to be completed.

Release Note

- Added the `--signature-digest-algorithm` flag to `cosign verify`, allowing verification of container image signatures which were generated with a non-SHA256 signature algorithm

[dlorenc]

2. I'm not totally sold on --signature-digest-algorithm as a flag name - it's a bit wordy. Happy to rename if someone has a better suggestion!

I couldn't think of anything better...

[SgtCoDFish]

Thanks very much, that was a really smooth process 😁