Add --bundle flag to sign-blob and verify-blob

[priyawadhwa]

Add in --bundle flag to cosign sign-blob and cosign verify-blob. The bundle stores everything required to verify a blob in a file, so now you can do something like this:

cosign sign-blob --bundle bundle.sig <blob> 

cosign verify-blob --bundle bundle.sig <blob> 

The bundle is basically just JSON with the Signature, Cert, and RekorBundle included.

Some thoughts I had, which might be future work:

• For now I put everything behind the --bundle flag, but later we might want sign-blob to print out the entire bundle instead of just the signature by default
• Right now other flags don't effect the output of --bundle, but later we might want certain flags to work together (e.g. --b64)
• Since we already have the concept of a "rekor bundle" maybe we should call this something else?

fixes #1193

Add --bundle flag to sign-blob and verify-blob

[haydentherapper]

For #1294, we're going to include a TUF timestamp in the OCI signature. Will this automatically pick this up, or will we need to append the timestamp to the bundle?

[dlorenc]

• For now I put everything behind the --bundle flag, but later we might want sign-blob to print out the entire bundle instead of just the signature by default

I'd be fine adding it by default now - this is only relevant for the COSIGN_EXPERIMENTAL sign-blob workflow right?

[priyawadhwa]

@haydentherapper I think it'll need to be added in, I can update that!

@dlorenc it should work for all workflows right now (for the regular workflow it'll just store the signature in the file and nothing else). Should we only do it for experimental right now?

[haydentherapper]

Thanks @priyawadhwa! #1294 has been merged. You should just need to add timestamp, err := tuf.GetTimestamp(ctx).