Sigstore for maintainers

[jku]

This is mostly to test the securesystemslib implementation:

• Allow using sigstore identity as maintainer key
• Add UI to ask for email and issuer if using sigstore identity
• Fix tests (but note that sigstore maintainer keys are not actually tested -- I think that is not easy)

TODO:

• should not ask for email and identity: should instead do the the token acquisition and read the token... Could do this as POC even before sigstore-python provides this (which I think they should)
• should verify when signing that the identity is the one we expect

cc @lukpueh

[lukpueh]

This looks super cool. I still need to understand the individual tools and how they play together a bit better to make any qualified comments on diffs. Will try to familiarise myself more soon.

[jku]

I still need to understand the individual tools and how they play together

Happy to do a video chat session to get you up to speed

[jku]

This could clearly be better (see TODOs in the pr message) but I'm merging now, let's handle those in other issues