Add cosign v3 bundle format with Fulcio cert caching

[codysoyland]

Summary

• Adds support for the cosign v3 bundle signing format (via sigstore-go) as an alternative to the legacy cosign v2 path
• Introduces a BundleSigner in the secant library with Fulcio certificate caching — the first sign operation fetches a cert via cbundle.SignData's built-in Fulcio flow, then extracts and caches it from the bundle output so subsequent operations skip Fulcio entirely
• Adds a configurable signature_format parameter (legacy, bundle, or both) at both provider and resource level
• Reuses cbundle.SignData from cosign/v3 for all signing logic, avoiding reimplementation of Fulcio client construction, Rekor, and TSA setup

Key changes

• pkg/private/secant/bundlesign.go — new BundleSigner struct with cert caching (30s expiry buffer), SignBundle(), and AttestBundle() functions
• internal/provider/provider.go — signature_format provider config, BundleSigner cached at provider level
• internal/provider/resource_sign.go / resource_attest.go — dual-path signing: legacy secant path and new bundle path based on signature_format
• internal/provider/oidc.go — OIDC token caching with JWT expiry awareness, shared across both signing paths

Test plan

• go build ./... compiles cleanly
• go test ./pkg/private/secant/... — cert caching unit tests pass
• go test ./internal/provider/... — provider tests pass
• go vet ./... — no issues
• End-to-end: configure default_signature_format = "bundle", sign an image, verify bundle is written as OCI referrer

🤖 Generated with Claude Code