EPIC: Create Pipeline Components and add support for Attestations/Signatures

[oates]

Is your feature request related to a problem? Please describe.

Many of our Software Factory users would like to have pipelines as a part of their overall solution to gain approval for applications faster than traditional, manual review processes. This need is very nuanced, however, in that any given customer is likely to have a different Approving Official (AO) and Information Assurance (IA) staff that will levy similar but different requirements on their development. Any given customer is also likely to have a relatively wide array of languages and technologies in use across their application portfolio with many applications making use of multiples of these at a time.

Additional context

Design doc -> https://docs.google.com/document/d/1MJZ4xFYEqy0LMjEw6N-jadFJ_KcsYbkcEeB7xFlfues/edit?tab=t.0#heading=h.othp216mmhlj

Splitting this EPIC into two categories of depth and breadth. Depth tasks will cover adding attestations and signatures to all pipeline components. Breadth tasks will cover creating new pipeline components.

Depth

Beta Give feedback

1. Add witness and creation of in-toto attestations to existing pipeline steps (using public sigstore for now though ideally configurable)
2. Add archivista uploading of attestations created in the pipeline
3. Add package signing for UDS Packages that are published
4. Validate any image signatures for included package images

Breadth

Beta Give feedback

1. Explore ways to add fuzzing to apps (OWASP ZAP / ossfuzz)
2. Improve linting / checking of Helm charts (add and validate values schemas)
3. Add an option to publish auxiliary images to registry uds-common#209
   +0
4. Determine way ahead on uds-forge (source code components)
5. Improve OSCAL / Lula integrations