ROX-34488: add e2e tests for referrer-based signature verification

[stehessel]

Description

Add two test images (public-key and keyless sigstore bundle) with corresponding deployments, integrations, and test matrix entries. Includes a runbook for recreating the signed test images.

User-facing documentation

• CHANGELOG.md is updated OR update is not needed
• documentation PR is created and is linked above OR is not needed

Testing and quality

• the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
• CI results are inspected

Automated testing

• added unit tests
• added e2e tests
• added regression tests
• added compatibility tests
• modified existing tests

How I validated my change

E2e test matrix in ImageSignatureVerificationTest.groovy extended with referrer-based deployments covering both public-key and keyless sigstore bundle verification. CHANGELOG updated.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

🚀 Build Images Ready

Images are ready for commit 0091490. To use with deploy scripts:

export MAIN_IMAGE_TAG=4.12.x-582-g0091490a28

[stehessel]

/test ocp-4-22-qa-e2e-tests gke-qa-e2e-tests ocp-4-21-qa-e2e-tests

[openshift-ci]

@stehessel: No presubmit jobs available for stackrox/stackrox@ROX-34488/3-bundle-verification

Details

In response to this:

/test ocp-4-22-qa-e2e-tests gke-qa-e2e-tests ocp-4-21-qa-e2e-tests

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.36%. Comparing base (a1f1f21) to head (83b8c74).

Additional details and impacted files

@@                         Coverage Diff                         @@
##           ROX-34488/3-bundle-verification   #21910      +/-   ##
===================================================================
- Coverage                            51.36%   51.36%   -0.01%     
===================================================================
  Files                                 2858     2858              
  Lines                               178986   178986              
===================================================================
- Hits                                 91939    91930       -9     
- Misses                               78989    78995       +6     
- Partials                              8058     8061       +3     

Flag	Coverage Δ
go-unit-tests	51.36% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.