Add a flag to disable ambient credential usage for cosign sign

[di]

Description

It'd be helpful to add a flag that prevents cosign sign from automatically picking up on ambient credentials. This would be useful for usage in environments that may have ambient credentials available, but the user might want to sign via the OAuth flow instead.

Right now, users need to manually determine which environment variables cosign is picking up on and unset/modify them when calling cosign sign to force it to use the OAuth flow.

[dlorenc]

sgtm!

[znewman01]

IMO you should be able to force it both ways: disallow ambient credential usage, or require it (with the default remaining as it is today: use it if it's there).