Added --client-signing-algorithms flag

[ret2libc]

Summary

Add --client-signing-algorithms flag to rekor-server to restrict the set of client keys accepted by a Rekor instance. See #1724 .

This work depends on sigstore/sigstore#1601

Release Note

Documentation

[codecov]

Codecov Report

Attention: Patch coverage is 0% with 82 lines in your changes are missing coverage. Please review.

Project coverage is 48.34%. Comparing base (488eb97) to head (4a0e998).
Report is 61 commits behind head on main.

Files	Patch %	Lines
pkg/api/entries.go	0.00%	48 Missing ⚠️
pkg/api/api.go	0.00%	20 Missing ⚠️
pkg/types/jar/v0.0.1/entry.go	0.00%	14 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #1974       +/-   ##
===========================================
- Coverage   66.46%   48.34%   -18.12%     
===========================================
  Files          92       80       -12     
  Lines        9258     6723     -2535     
===========================================
- Hits         6153     3250     -2903     
- Misses       2359     3069      +710     
+ Partials      746      404      -342     

Flag	Coverage Δ
e2etests	?
unittests	48.34% <0.00%> (+0.65%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[ret2libc]

--- FAIL: TestJAR (0.07s)
    e2e_test.go:33: Using config file:%!(EXTRA string=/tmp/rekor_test.9ofp49.rekor.yaml)
        [POST /api/v1/log/entries][400] createLogEntryBadRequest  &{Code:400 Message:error processing entry: getting verifiers: jar v0.0.1 entry not initialized}
        warning: GOCOVERDIR not set, no coverage data emitted

Apparently the e2e test does not fill the Signature part of the JARModel:

	if v.JARModel.Signature == nil || v.JARModel.Signature.PublicKey == nil || v.JARModel.Signature.PublicKey.Content == nil {
		return nil, errors.New("jar v0.0.1 entry not initialized")
	}

Shall this be handled or is the signature always expected to be present?

[haydentherapper]

Signature should be present, it's required to validate a new jar entry -

rekor/pkg/types/jar/v0.0.1/entry.go

Line 248 in d596e9d

if v.JARModel.Signature == nil || v.JARModel.Signature.Content == nil {

[bobcallaway]

still needs removed before merge