chore: add a note about SIGSTORE_REKOR_PUBLIC_KEY var

[hectorj2f]

Signed-off-by: hectorj2f hectorf@vmware.com

Summary

I learned this week that SIGSTORE_REKOR_PUBLIC_KEY env variable is used for testing purposes only. So we should add it to the warning and the code docs.

Ticket Link

Fixes

Release Note

Warn when using SIGSTORE_REKOR_PUBLIC_KEY env variable, it is only for testing.

[codecov-commenter]

Codecov Report

Merging #2040 (31c1968) into main (94832ba) will not change coverage.
The diff coverage is 0.00%.

@@           Coverage Diff           @@
##             main    #2040   +/-   ##
=======================================
  Coverage   26.22%   26.22%           
=======================================
  Files         128      128           
  Lines        7539     7539           
=======================================
  Hits         1977     1977           
  Misses       5307     5307           
  Partials      255      255           

Impacted Files	Coverage Δ
pkg/cosign/tlog.go	30.07% <0.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 94832ba...31c1968. Read the comment docs.