dx: revise the --upload and add --output-signature flags

[Dentrax]

Description

From the discussion we had here with @imjasonh and @developer-guy, dropping the idea here, so we do not forget!

--upload --skip-upload

We currently use the --upload=false flag to decide whether to upload the signature, true by default. Since passing true does not change the current logic, I think it had better to rename this flag something like: --skip-upload.

--output-signature

If we are working with the pull-through cache/mirror repositories, we probably want to skip the upload stage and export the signature to a specified file by defining an --output-signature.

[imjasonh]

FWIW, --upload=(true|false) sounds just fine to me, I don't think renaming it is worth breaking current users or going through a deprecation and switch-over.

In general I don't think we should feel the need to change cosign's CLI or Go packages just to support the relatively exotic and esoteric use case that kontain.me is shooting for.

[dekkagaijin]

cc @n3wscott