Improve json output of cosign verify

[ribbybibby]

Description
From this discussion: https://sigstore.slack.com/archives/C01PZKDL4DP/p1643231244166000

At the moment, cosign verify returns something like this:

[
  {
    "critical": {
      "identity": {
        "docker-reference": "ghcr.io/jimbugwadia/pause2"
      },
      "image": {
        "docker-manifest-digest": "sha256:b31bfb4d0213f254d361e0079deaaebefa4f82ba7aa76ef82e90b4935ad5b105"
      },
      "type": "cosign container image signature"
    },
    "optional": {
      "Bundle": {
        "SignedEntryTimestamp": "MEYCIQD/1Gy6s6DNtELetftKzpV8YndhwWiWR402w480eQg28gIhALcp+mIYcvgvaKz8qjNZLDeOYJ8heG3hHznpOhwN6Pku",
        "Payload": {
          "body":   .<TRIM>,
          "integratedTime": 1643182752,
          "logIndex": 1161837,
          "logID": "c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d"
        }
      },
      "Issuer": "https://github.com/login/oauth",
      "Subject": "..."
    }
  }
]

The optional fields there aren't actually part of the payload, they're added in by cosign verify here.

The 'optional' information there is very useful but I think it's deceiving because (as was evidenced in the slack conversation) it created confusion when trying to check the contents of the payload in another context.

I was thinking some representation of this interface might be clearer because it would correspond to the functions available when dealing with signatures in your code.

It would also provide a decent amount of information that could be piped into policy engines or used in other contexts:

cosign verify | opa eval --stdin-input '<policy>'

Something like this:

{
  "annotations": {
    "foo": "bar",
    "bar": "foo"
  },
  "payload": .<TRIM>.,
  "cert": {
    "iss": "https://github.com/login/oauth",
    "sub": "..."
  },
  "bundle": {
    "SignedEntryTimestamp": "MEYCIQD/1Gy6s6DNtELetftKzpV8YndhwWiWR402w480eQg28gIhALcp+mIYcvgvaKz8qjNZLDeOYJ8heG3hHznpOhwN6Pku",
    "Payload": {
      "body":   .<TRIM>,
      "integratedTime": 1643182752,
      "logIndex": 1161837,
      "logID": "c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d"
    }
  },
  "timestamp": 1643182752
}

@dlorenc @developer-guy @JimBugwadia

[dlorenc]

I like this idea!

[znewman01]

This may be more appropriate for a new cosign inspect verb (#2210).

See #2056 for background.

[ribbybibby]

cosign inspect looks like a much better approach to this so I'll close this in favour of that.