feat: support cosign veryf-blob's --bundle option

[suzuki-shunsuke]

Close #3682

https://aquaproj.github.io/docs/reference/registry-config/cosign/

This pull request adds a field .cosign.bundle to support cosign verify-blob's --bundle option.
This is same with cosign's other settings such as key, certificate, and signature.

e.g. https://github.com/cert-manager/cmctl/releases/tag/v2.1.1

cosign:
  bundle:
    type: github_release
    asset: checksums.txt.cosign.bundle

[suzuki-shunsuke]

Hmm. It doesn't work.

packages:
  - type: github_release
    repo_owner: cert-manager
    repo_name: cmctl
    description: the command line utility that makes cert-manager'ing easier
    version_constraint: "false"
    version_overrides:
      - version_constraint: "true"
        asset: cmctl_{{.OS}}_{{.Arch}}
        format: raw
        checksum:
          type: github_release
          asset: checksums.txt
          algorithm: sha256
          cosign:
            bundle:
              type: github_release
              asset: checksums.txt.cosign.bundle

$ ~/go/bin/aqua exec -- cmctl -v
INFO[0000] download and unarchive the package            aqua_version= env=darwin/arm64 exe_name=cmctl package_name=cert-manager/cmctl package_version=v2.1.1 program=aqua registry=standard
Downloading cert-manager/cmctl v2.1.1 100% |█████████████████████████████████████████████████████████████████| (60/60 MB, 34 MB/s)        
INFO[0003] downloading a checksum file                   aqua_version= env=darwin/arm64 exe_name=cmctl package_name=cert-manager/cmctl package_version=v2.1.1 program=aqua registry=standard
error: flag needs an argument: 'v' in -v

[suzuki-shunsuke]

Error: --certificate-identity or --certificate-identity-regexp is required for verification in keyless mode
error during command execution: --certificate-identity or --certificate-identity-regexp is required for verification in keyless mode
FATA[0008] aqua failed                                   aqua_version= asset_name=cmctl_darwin_arm64 cosign_opts="--bundle, /var/folders/fc/1bgyy3_d3x90m_t04qbw5f8m0000gn/T/390486144" env=darwin/arm64 error="install the package: verify the checksum file: verify a file with Cosign: verify a signature file with Cosign: verify with Cosign" exe_name=cmctl package_name=cert-manager/cmctl package_version=v2.1.1 program=aqua target=/var/folders/fc/1bgyy3_d3x90m_t04qbw5f8m0000gn/T/671907941

[suzuki-shunsuke]

Okay. It worked.

• fix(cert-manager/cmctl): configure Cosign aqua-registry#33992

$ ~/go/bin/aqua exec -- cmctl -V
INFO[0000] download and unarchive the package            aqua_version= env=darwin/arm64 exe_name=cmctl package_name=cert-manager/cmctl package_version=v2.1.1 program=aqua registry=standard
Downloading cert-manager/cmctl v2.1.1 100% |█████████████████████████████████████████████████████████████████| (60/60 MB, 37 MB/s)        
INFO[0002] downloading a checksum file                   aqua_version= env=darwin/arm64 exe_name=cmctl package_name=cert-manager/cmctl package_version=v2.1.1 program=aqua registry=standard
INFO[0003] verifying a file with Cosign                  aqua_version= env=darwin/arm64 exe_name=cmctl package_name=cert-manager/cmctl package_version=v2.1.1 program=aqua registry=standard
Verified OK
error: unknown shorthand flag: 'V' in -V

packages:
  - type: github_release
    repo_owner: cert-manager
    repo_name: cmctl
    description: the command line utility that makes cert-manager'ing easier
    version_constraint: "false"
    version_overrides:
      - version_constraint: "true"
        asset: cmctl_{{.OS}}_{{.Arch}}
        format: raw
        checksum:
          type: github_release
          asset: checksums.txt
          algorithm: sha256
          cosign:
            bundle:
              type: github_release
              asset: checksums.txt.cosign.bundle
            opts:
              - --certificate-oidc-issuer
              - "https://token.actions.githubusercontent.com"
              - --certificate-identity
              - https://github.com/cert-manager/cmctl/.github/workflows/release.yaml@refs/tags/{{.Version}}