OCIRepository verification doesn't not support contextual login

[souleb]

In #876, artifact signature verification with cosign has been added.

When calling

err := r.verifyOCISourceSignature(ctx, obj, url, keychain)

We pass the keychain fetch from a secret containing the needed credentials, but we do not take into account the authenticator that is retrieved from the cloud provider.

[stefanprodan]

Not only that, the verify function also doesn't set insecure and any transport customisations like root CAs 😱

Thanks @souleb for finding this before the release.