Add support for signing with Sigstore

[travier]

Description

Add support for signing with Sigstore

Related Issue(s)

Fixes: #89

Checklist

• This PR includes a documentation change
• This PR does not need a documentation change

---

• This PR includes test changes
• This PR's changes are already tested

---

• This change is not user-facing
• This change is a patch change
• This change is a minor change
• This change is a major (breaking) change

Changes made

README: Fix Markdown lints and typos

---

Add support for signing with Sigstore

Fixes: #89

---

Update node dependencies: npm audit fix --force

---

Update bundle: rpm run bundle

[travier]

I'm currently testing this change in this repo: https://github.com/travier/cosign-test

This needs a newer podman version than the one currently available in Ubuntu 22.04 (ubuntu-latest), thus I'm installing it from https://podman.io/docs/installation#ubuntu

[travier]

Error: initializing private key: decrypt: encrypted: unexpected kdf parameters

🤔

Filed as containers/podman#20771.

[travier]

I now have a working setup with https://github.com/travier/podman-action & https://github.com/travier/cosign-test which works with this PR.

Example multi-arch, podman signed build in https://github.com/travier/cosign-test/blob/main/.github/workflows/nginx.yml.

[travier]

This should work once the Ubuntu 24.04 runner images become the default.

[travier]

I've rebased this PR which should now be ready as the Ubuntu 24.04 runners have a recent enough podman version.