Add bundle create helper command

[steiza]

Summary

Working towards #3139.

There are several cosign commands that now support the new protobuf bundle format. Users may have signed material in other formats, and this pull request adds a cosign bundle create... helper to assemble that material into a new protobuf bundle for use with the work in #3139.

You can test this with something like:

$ go run cmd/cosign/main.go attest-blob --bundle "old.bundle" --identity-token="..." --type=something --predicate=predicate.txt ../sigstore-go/examples/sigstore-go-signing/hello_world.txt

$ go run cmd/cosign/main.go bundle create --bundle=old.bundle --attestation=intoto.txt --artifact=../sigstore-go/examples/hello_world.txt --out test.sigstore.json

$ go run cmd/cosign/main.go verify-blob-attestation --bundle="test.sigstore.json" --new-bundle-format=true --type=something --certificate-oidc-issuer="https://token.actions.githubusercontent.com" --certificate-identity="https://github.com/sigstore-conformance/extremely-dangerous-public-oidc-beacon/.github/workflows/extremely-dangerous-oidc-beacon.yml@refs/heads/main" ../sigstore-go/examples/sigstore-go-signing/hello_world.txt

Release Note

• Added cosign bundle create command to assist users in assembling signed content into the new protobuf bundle format to use in cosign verification commands

Documentation

sigstore/docs#327

[codecov]

Codecov Report

Attention: Patch coverage is 20.85714% with 277 lines in your changes missing coverage. Please review.

Project coverage is 36.19%. Comparing base (2ef6022) to head (ff8128a).
Report is 225 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/cosign/cli/bundle/bundle.go	13.60%	95 Missing and 13 partials ⚠️
cmd/cosign/cli/verify/verify_bundle.go	23.94%	99 Missing and 9 partials ⚠️
cmd/cosign/cli/options/bundle.go	0.00%	40 Missing ⚠️
cmd/cosign/cli/bundle.go	47.50%	20 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3901      +/-   ##
==========================================
- Coverage   40.10%   36.19%   -3.91%     
==========================================
  Files         155      206      +51     
  Lines       10044    13144    +3100     
==========================================
+ Hits         4028     4758     +730     
- Misses       5530     7780    +2250     
- Partials      486      606     +120     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.