Refactor verifyNewBundle into library function

[codysoyland]

Summary

This is a refactor of the bundle verification logic that replaces verifyNewBundle with a re-written library function cosign.VerifyNewBundle, which accepts a simplified set of arguments, using CheckOpts to supply the majority of the configuration. It has been moved out of the cli package into the cosign package and made public.

This is partially extracted from #3889.

Release Note

Documentation

[codecov]

Codecov Report

Attention: Patch coverage is 48.32536% with 108 lines in your changes missing coverage. Please review.

Project coverage is 36.46%. Comparing base (2ef6022) to head (5932f1f).
Report is 278 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/cosign/cli/verify/verify_blob.go	37.07%	46 Missing and 10 partials ⚠️
cmd/cosign/cli/verify/verify_blob_attestation.go	40.38%	26 Missing and 5 partials ⚠️
pkg/cosign/verify.go	74.13%	10 Missing and 5 partials ⚠️
pkg/cosign/verify_bundle.go	40.00%	4 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4013      +/-   ##
==========================================
- Coverage   40.10%   36.46%   -3.65%     
==========================================
  Files         155      210      +55     
  Lines       10044    13351    +3307     
==========================================
+ Hits         4028     4868     +840     
- Misses       5530     7872    +2342     
- Partials      486      611     +125     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[codysoyland]

@haydentherapper @cmurphy @steiza I would appreciate a look at this whenever you have a moment!

[steiza]

Nice work! I don't have any further comments other than the things already raised by @malancas.

[codysoyland]

I will take a look at the conformance failures Monday. Thanks all!

[malancas]

LGTM 🚀