Support mTLS towards container registry

[zpon]

Summary

Some container registries require that the client present a certificate when establishing the connection. There is currently no way of specifying this when using cosign.
This change adds four arguments that allows the users to specify the root CA, the client cert and the client key and the expected SAN name.

Release Note

• Config changes (additions, deletions, updates)
  • None
• API additions—new endpoint, new response fields, or newly accepted request parameters
  • None
• Database changes (any)
  • None
• Websocket additions or changes
  • None
• Anything noteworthy to an administrator running private sigstore instances (err on the side of over-communicating)
  • It is now possible to specify client certificates (mTLS) for container registry connections
• New features and improvements, including behavioural changes, UI changes and CLI changes
  • It is now possible to specify client certificates (mTLS) for container registry connections
• Bug fixes and fixes of previous known issues
  • None
• Deprecation warnings, breaking changes, or compatibility notes
  • None

Documentation

Documentation has been added for these new arguments added:

      --registry-cacert string                                                                   path to the X.509 CA certificate file in PEM format to be used for the connection to the registry
      --registry-client-cert string                                                              path to the X.509 certificate file in PEM format to be used for the connection to the registry
      --registry-client-key string                                                               path to the X.509 private key file in PEM format to be used, together with the 'registry-client-cert' value, for the connection to the registry
      --registry-server-name string                                                              SAN name to use as the 'ServerName' tls.Config field to verify the mTLS connection to the registry

All code is Copyright 2024 by Uber Technologies, Inc.

Closes #3915

[codecov]

Codecov Report

Attention: Patch coverage is 60.86957% with 18 lines in your changes missing coverage. Please review.

Project coverage is 36.35%. Comparing base (2ef6022) to head (bab0180).
Report is 236 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/cosign/cli/options/registry.go	60.86%	17 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3922      +/-   ##
==========================================
- Coverage   40.10%   36.35%   -3.75%     
==========================================
  Files         155      209      +54     
  Lines       10044    13379    +3335     
==========================================
+ Hits         4028     4864     +836     
- Misses       5530     7889    +2359     
- Partials      486      626     +140     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[haydentherapper]

Thank you for your contribution!

[zpon]

Thank you for your contribution!

@haydentherapper Thanks for the approval. I added another commit to fix unittest on Windows. Can you take another look?