Make the the invalid CA error message actionable

[tstromberg]

Signed-off-by: Thomas Stromberg t+github@chainguard.dev

Summary

This PR improves the error message when an invalid --ca is provided by making it directly actionable. This lowers the friction for folks like me who are blindly pasting lines from the sigstore-the-hard-way doc.

When I first saw the error message, it did not occur to me that it referenced the --ca value versus an expected value within the key pair. Here is the example command-line to trigger the condition:

fulcio serve --config-path=fulcio-config.json --ca=fulcioca --hsm-caroot-id=1 --ct-log-url=http://localhost:6105/sigstore --host=0.0.0.0 --port=5000

Old output

FATAL app/serve.go:119 unknown CA: fulcioca

New output

FATAL app/serve.go:119 --ca=fulcioca is not a valid selection. Try: pkcs11ca, googleca, fileca, or ephemeralca

Release Note

NONE

[cpanato]

cool, thanks

LGTM