Add support for new bundle specification in cosign attest

[codysoyland]

This PR adds support for the new Cosign Bundle Specification in cosign attest.

Related: #3139

This is in draft for now pending:

• TSA timestamp payload modified per spec and added to bundle
• New annotations are added
• Support for fallback to referrers tag schema
• Tests

To test, run the following (replacing MY_PREDICATE and MY_IMAGE as needed):

go run ./cmd/cosign attest --predicate MY_PREDICATE --new-bundle-format MY_IMAGE

Summary

Release Note

Documentation

[codecov]

Codecov Report

Attention: Patch coverage is 0% with 107 lines in your changes missing coverage. Please review.

Project coverage is 36.31%. Comparing base (2ef6022) to head (a8e4b5a).
Report is 219 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/oci/remote/write.go	0.00%	89 Missing ⚠️
cmd/cosign/cli/attest/attest.go	0.00%	15 Missing ⚠️
cmd/cosign/cli/options/attest.go	0.00%	2 Missing ⚠️
cmd/cosign/cli/attest.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3888      +/-   ##
==========================================
- Coverage   40.10%   36.31%   -3.79%     
==========================================
  Files         155      203      +48     
  Lines       10044    12914    +2870     
==========================================
+ Hits         4028     4690     +662     
- Misses       5530     7641    +2111     
- Partials      486      583      +97     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.