Support verifying digests in addition to artifacts

[facutuesca]

This PR adds support for verifying hashes (instead of files) to the CLI protocol (only when verifying bundles).

It also adapts the sigstore-python-conformance helper to support it, given sigstore-python supports verifying hashes since v3.3.0.

All the existing bundle verification tests have been parametrized to also test the hash verification, in addition to the existing Path (file) verification.

This closes #157

cc @woodruffw

[woodruffw]

LGTM, nice work @facutuesca!

This is good to go, but CCing @steiza @kommendorkapten @loosebazooka as other client maintainers who will probably want to be aware of this as it goes in -- you'll likely need to update your conformance wrappers!

[steiza]

Adding @bdehamer for sigstore-js.

This should be fine for sigstore-go - it's easy for us to set our verification policy accordingly. I don't think this will work with cosign, which maps verify-bundle to cosign verify-blob, which only supports URLs and files, not digests.

But that's not a problem with this pull request - we'll have to figure out how to have cosign additionally handle digests, maybe as part of the VerifierOptions @codysoyland suggested in sigstore/cosign#3879.

[woodruffw]

Thanks @facutuesca, nice work here!