Enable signing and verifying image without registry access

[bkabrda]

Summary

Fixes #3832.
This PR essentially enables:

• Signing an image with the --upload=false flag even if the image registry is (temporarily) unavailable.
• Properly verifying and image offline with certificate, payload and signature
  • There was previously a bug doing this, as the tlog function would attempt to search tlog by public key, when instead it needs to submit the certificate (see Improve clarity that the publicKey field accepts an X509 certificate rekor#809).

I tried my best to test all the code paths that go through this function, but to be honest there are so many that I'm not 100 % everything is still correct - a thorough review would be appreciated.

Release Note

• It is now possible to sign an image when the image registry is unreachable when using --upload=false.
• The TLog search now works properly when verifying image using disconnected certificate, payload and signature.

Documentation

I don't believe this PR requires documentation change.

[codecov]

Codecov Report

Attention: Patch coverage is 18.51852% with 22 lines in your changes missing coverage. Please review.

Project coverage is 36.44%. Comparing base (2ef6022) to head (4535d70).
Report is 278 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/cosign/verify.go	20.00%	18 Missing and 2 partials ⚠️
cmd/cosign/cli/sign/sign.go	0.00%	1 Missing ⚠️
cmd/cosign/cli/verify/verify.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4014      +/-   ##
==========================================
- Coverage   40.10%   36.44%   -3.66%     
==========================================
  Files         155      209      +54     
  Lines       10044    13371    +3327     
==========================================
+ Hits         4028     4873     +845     
- Misses       5530     7875    +2345     
- Partials      486      623     +137     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.