Retrieve and validate signing of blob (script)

[lukehinds]

Once we have programmatically completed step #4 we need retrieve the script and validate the signing.

• Perform OCI pull of the script
• Perform OCI pull of the signature manifest
• Verify that signers within the signature manifest are also in the root policy validated as part of #4
• Verify the signature manifest is present in rekor
• Hash the artefact (script)
• Validate the signing of the artefact by each listed maintainer

See https://docs.google.com/document/d/12BBOXMhA99J3KzNaotT1J4OTSDlNnK110_9FZkPv-A0 for more details

cc @lkatalin @asraa @jyotsna-penumaka