gitsign verify

[wlynch]

Description

We should add a gitsign verify command that follows cosign verify. e.g.

gitsign verify --certificate-identity <email> --certificate-oidc-issuer <idp provider> <revision>

The current git commit-verify flow is somewhat limited in that it only verifies that the signature matches, not that the identity matches a certain IdP (see #104 (comment) for more discussion). We should add a separate subcommand that explicitly verifies a given identity + provider pair.

We'll look to see how we can additional verification configuration in the future to git verify-commit (some interesting discussions going on with TUF folks), but this gives us a short-term solution in the meantime.