fix: validate plugin version for ratify cli

[susanshi]

Description

What this PR does / why we need it:

validate the plugin version in verifier config against supported versions defined by plugins

Which issue(s) this PR fixes (optional, using fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when the PR gets merged):

Fixes #1199

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Helm Chart Change (any edit/addition/update that is necessary for changes merged to the main branch)
• This change requires a documentation update

How Has This Been Tested?

Test results with incompatible version.

 { "verifierReports": [ { "isSuccess": false, "name": "sbom", "message": "Original Error: (Original Error: (plugin failed with error: 'exit status 1', msg from stError '', msg from stdOut '{\n \"code\": 6,\n \"msg\": \"plugin doesn't support version 3.0.0\"\n}'), Error: verify plugin failure, Code: VERIFY_PLUGIN_FAILURE, Plugin Name: sbom, Component Type: verifier), Error: verify reference failure, Code: VERIFY_REFERENCE_FAILURE, Plugin Name: sbom, Component Type: verifier", "artifactType": "application/spdx+json" } ] }

Checklist:

• Does the affected code have corresponding tests?
• Are the changes documented, not just with inline documentation, but also with conceptual documentation such as an overview of a new feature, or task-based documentation like a tutorial? Consider if this change should be announced on your project blog.
• Does this introduce breaking changes that would require an announcement or bumping the major version?
• Do all new files have appropriate license header?

Post Merge Requirements

• MAINTAINERS: manually trigger the "Publish Package" workflow after merging any PR that indicates Helm Chart Change

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Files	Coverage Δ
pkg/verifier/factory/factory.go	65.51% <100.00%> (+1.88%)	⬆️

... and 2 files with indirect coverage changes

[binbin-li]

lgtm, thanks for the fix!

[akashsinghal]

LGTM