Private PKI cli constraint options

[pkwiatkowski1]

Description

Building off this issue created in the conformance repo.

We're specifically having verification issues of the code signing EKU with a privately deployed Fulcio (based off the certificate configuration) but it'd be useful to introduce the ability to ease constraints depending on the environment cosign is executed in (private vs public).