Bundle creation and consumption specs

[tnytown]

Specifies bundle creation and consumption standards by:

• adding sign-bundle and verify-bundle subcommands;
• adding the --bundle flag that specifies the bundle to output or verify from.

I'm unsure of if we want to have separate sign-bundle and verify-bundle subcommands, as I mentioned in #65 (comment). I can remove these subcommands and make some flags optional if we feel that approach is better.

Resolves #51.

[tetsuo-cpp]

I understand where you're coming from regarding the flags. I guess my only concern is that sigstore-java are using their CLI not just for conformance testing but for some internal CI stuff to sign/verify things (from my memory). So this approach (which I'd say is a bit less ergonomic) will affect them too.

@loosebazooka Would it be ok if we switch the sigstore-java CLI to use sign-bundle and verify-bundle as separate subcommands rather than a --bundle flag? I'm happy to put a PR together, it's more about whether you intend to use the CLI more extensively.

[tetsuo-cpp]

LGTM! Provided that the sigstore-java folks are happy with this approach, let's go with this.

[tnytown]

Also happy to just collapse them into the same subcommand! I took a crack at implementing some basic bundle tests and since sigstore-python doesn't have separate subcommands, implementing this for the shim is just a matter of deleting -bundle.

[loosebazooka]

@tetsuo whatever you need for conformance works for us. The cli is not a released artifact and will never be. It's purely for conformance and other testing.

The cli framework we're using lets us create required mutually exclusive groups (--bundle OR --cert/--sig), so that's why it's in there like that for now.

[tetsuo-cpp]

@loosebazooka Awesome, thanks for explaining.