Add support for attesting with complete statement

[codysoyland]

Summary

Add support for signing attestations given a complete statement. This is an alternative to passing in a predicate and having cosign generate the statement.

This adds a new flag to attest and attest-blob, --statement, which accepts a complete in-toto statement. If provided, the predicate flag is ignored and the statement is signed.

Fixes #4019

Release Note

Documentation

[codecov]

Codecov Report

Attention: Patch coverage is 23.62205% with 97 lines in your changes missing coverage. Please review.

Project coverage is 36.43%. Comparing base (2ef6022) to head (fc7349d).
Report is 289 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/cosign/cli/attest/attest.go	0.00%	44 Missing ⚠️
cmd/cosign/cli/attest/attest_blob.go	46.15%	23 Missing and 12 partials ⚠️
cmd/cosign/cli/attest_blob.go	0.00%	9 Missing ⚠️
cmd/cosign/cli/options/predicate.go	0.00%	5 Missing ⚠️
cmd/cosign/cli/attest.go	0.00%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4032      +/-   ##
==========================================
- Coverage   40.10%   36.43%   -3.68%     
==========================================
  Files         155      209      +54     
  Lines       10044    13398    +3354     
==========================================
+ Hits         4028     4881     +853     
- Misses       5530     7892    +2362     
- Partials      486      625     +139     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[codysoyland]

We may go another direction with this, see #4019 (comment)

[haydentherapper]

For the attest-blob path, this LGTM.

For the attest path, you've convinced me that it's confusing to have a required parameter for OCI but to ignore the OCI manifest as the subject.

So I think we should either:

1. Make this its own command, and optionally (later?) add support for uploading an attestation to OCI, with (optional?) subject comparison
2. Drop attest --statement support from this PR, though now we have somewhat confusing deviations between the two commands, which is why I'm leaning more towards 1 now.