Bump sigstore, remove deprecated email identity setting

[woodruffw]

WIP. This is probably going to break the CI, since we still do verifications by default but don't always pass in the necessary options.

Removes the verify-oidc-email setting, since it maps to a now-removed sigstore CLI option. This release family of sigstore also makes the various verification options mandatory, so we no longer allow a user to pass verify: true without also passing the specific verification fields they'd like to verify with.

[woodruffw]

cc @tetsuo-cpp: with these changes, I think we have a couple of options:

• Disable verification by default: we were doing it primarily as a "smoke test" for the action, but I think the state of our CI both here and on sigstore-python itself now provides sufficient confidence.
• Keep verification enabled, and infer the correct verification options to pass. When an ambient credential is used this is very easy; when the user passes in their own OIDC identity then we'll also need to enforce that they supply verify-oidc-issuer and verify-cert-identity.

Thoughts?

[woodruffw]

I've tweaked the PR to disable verification by default, just to demonstrate what I'm thinking.

Edit: I've also added a matrix of xfail tests, to demonstrate expected failure modes.