Add support for new bundle specification in cosign attest

[codysoyland]

This PR adds support for the new Cosign Bundle Specification in cosign attest.

Related: #3139

This is in draft for now pending:

• TSA timestamp payload modified per spec and added to bundle
• New annotations are added
• Support for fallback to referrers tag schema
• Tests

To test, run the following (replacing MY_PREDICATE and MY_IMAGE as needed):

go run ./cmd/cosign attest --predicate MY_PREDICATE --new-bundle-format MY_IMAGE

Summary

Release Note

Documentation

[codecov]

Codecov Report

Attention: Patch coverage is 0.70922% with 140 lines in your changes missing coverage. Please review.

Project coverage is 36.32%. Comparing base (2ef6022) to head (f6b6f81).
Report is 236 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/oci/remote/write.go	0.00%	89 Missing ⚠️
cmd/cosign/cli/attest/attest.go	0.00%	32 Missing ⚠️
cmd/cosign/cli/attest/common.go	0.00%	10 Missing ⚠️
cmd/cosign/cli/attest/attest_blob.go	14.28%	6 Missing ⚠️
cmd/cosign/cli/options/attest.go	0.00%	2 Missing ⚠️
cmd/cosign/cli/attest.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3888      +/-   ##
==========================================
- Coverage   40.10%   36.32%   -3.79%     
==========================================
  Files         155      203      +48     
  Lines       10044    12923    +2879     
==========================================
+ Hits         4028     4694     +666     
- Misses       5530     7646    +2116     
- Partials      486      583      +97     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[codysoyland]

This PR has been combined into #3889