build: add image signing for dev images and add release sbom

[akashsinghal]

Description

What this PR does / why we need it:

• introduces dev image signing using cosign keyless and notation
• adds notation public cert to .well-known/ratify-verification.crt. Note the cert will be downloaded from the ratify.dev website. See docs: add signature verification guidance for dev assets ratify-web#95
• add sbom generation to goreleaser: See sample Assets from a release below
  

Which issue(s) this PR fixes (optional, using fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when the PR gets merged):

Fixes #1658

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Helm Chart Change (any edit/addition/update that is necessary for changes merged to the main branch)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Please also list any relevant details for your test configuration

• Test A
• Test B

Checklist:

• Does the affected code have corresponding tests?
• Are the changes documented, not just with inline documentation, but also with conceptual documentation such as an overview of a new feature, or task-based documentation like a tutorial? Consider if this change should be announced on your project blog.
• Does this introduce breaking changes that would require an announcement or bumping the major version?
• Do all new files have appropriate license header?

Post Merge Requirements

• MAINTAINERS: manually trigger the "Publish Package" workflow after merging any PR that indicates Helm Chart Change

[akashsinghal]

View sample success run here: https://github.com/akashsinghal/ratify/actions/runs/9898814007/job/27346427829

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

[susanshi]

LGTM. thanks!

[binbin-li]

lgtm

[junczhu]

LGTM

[susanshi]

to merge after #1641

[akashsinghal]

After this PR is merged, the following secrets and variables MUST be added to Ratify and each fork of Ratify that will run AKS and dev publishing workflows:

Secrets:

• AZURE_SUBSCRIPTION_ID
• AZURE_TENANT_ID
• AZURE_CLIENT_ID
• AZURE_KV_KEY_ID: The azure keyvault key URL

Variables:

• AZURE_KV_PLUGIN_URL: This is the notation-azure plugin binary download URL
• AZURE_KV_CHECKSUM: This is the checksum value of the plugin binary

[susanshi]

LGTM. thanks!