Added --client-signing-algorithms flag

[ret2libc]

Summary

Add --client-signing-algorithms flag to rekor-server to restrict the set of client keys accepted by a Rekor instance. See #1724 .

This work depends on sigstore/sigstore#1601

Release Note

Documentation

[codecov]

Codecov Report

Attention: Patch coverage is 7.33945% with 101 lines in your changes missing coverage. Please review.

Project coverage is 41.78%. Comparing base (488eb97) to head (c31e028).
Report is 300 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/api/entries.go	0.00%	56 Missing ⚠️
pkg/api/api.go	0.00%	24 Missing ⚠️
pkg/types/jar/v0.0.1/entry.go	0.00%	19 Missing ⚠️
cmd/rekor-server/app/root.go	80.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #1974       +/-   ##
===========================================
- Coverage   66.46%   41.78%   -24.68%     
===========================================
  Files          92      192      +100     
  Lines        9258    24857    +15599     
===========================================
+ Hits         6153    10387     +4234     
- Misses       2359    13695    +11336     
- Partials      746      775       +29     

Flag	Coverage Δ
e2etests	?
unittests	41.78% <7.33%> (-5.90%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[ret2libc]

--- FAIL: TestJAR (0.07s)
    e2e_test.go:33: Using config file:%!(EXTRA string=/tmp/rekor_test.9ofp49.rekor.yaml)
        [POST /api/v1/log/entries][400] createLogEntryBadRequest  &{Code:400 Message:error processing entry: getting verifiers: jar v0.0.1 entry not initialized}
        warning: GOCOVERDIR not set, no coverage data emitted

Apparently the e2e test does not fill the Signature part of the JARModel:

	if v.JARModel.Signature == nil || v.JARModel.Signature.PublicKey == nil || v.JARModel.Signature.PublicKey.Content == nil {
		return nil, errors.New("jar v0.0.1 entry not initialized")
	}

Shall this be handled or is the signature always expected to be present?

[haydentherapper]

Signature should be present, it's required to validate a new jar entry -

rekor/pkg/types/jar/v0.0.1/entry.go

Line 248 in d596e9d

if v.JARModel.Signature == nil || v.JARModel.Signature.Content == nil {

[bobcallaway]

still needs removed before merge