Add GQ proof of authentication checking.

[znewman01]

Requires a modified version of Fulcio that embeds a JWT header/body (no signature) into the certificate, along with the GQ proof of authentication.

Changes include:

• Added the GQ-based proof-of-authentication library in pkg/cosign/poa.
• Add support for deserializing the new extensions for JWT token header/body and GQ proof.
• Disable some (important!) checks, like requiring a signed timestamp, to make local testing easier.
• Hard-code the Sigstore Dex instance's JWK URL. This should use OIDC discovery and a local cache.
• Check the GQ proof in verification.

Needs (substantial) cleanup before merge, but serves as a proof-of-concept.

Can be verified by starting the modified Fulcio:

$ go run main.go serve --port 5555 --ca ephemeralca --ct-log-url=""

Then, sign and verify:

$ ./cosign sign-blob \                                                                                                                                                                        ~/git/cosign
    --fulcio-url http://localhost:5555 \
    --insecure-skip-verify \
    --tlog-upload=false \
    --output-certificate crt.pem.b64 \
    --output-signature sig \
    --yes \
    /dev/null
$ export SIGSTORE_ROOT_FILE=<(curl http://localhost:5555/api/v1/rootCert)
$ ./cosign verify-blob \
    --certificate-oidc-issuer https://accounts.google.com \
    --certificate-identity zjn@chainguard.dev \
    --certificate <(base64 -d crt.pem.b64) \
    --signature sig \
    --insecure-ignore-tlog \
    --insecure-ignore-sct=true \
    /dev/null

[github-actions]

This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[github-actions]

This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[github-actions]

This PR was closed because it has been stalled for 10 days with no activity.