integration test for signing w/ GH Sigstore

[bdehamer]

Sets-up an integration test which uses the Github Sigstore instance to sign the provenance statement.

Typically, the Sigstore instance is selected automatically based on the visibility of the repo which initiates the workflow. Given that this repo is public, I introduced an undocumented input argument which can be used to force the selection of the private Sigstore instance.

[kommendorkapten]

The code looks good, but I'm thinking about if we can change the name of the environment variable, INPUT_PRIVATE does not reveal much of it's intent. Even if this is an undocumented private variable, I would think a more descriptive name:

• INPUT_PRIVATE_CA
• INPUT_PRIVATE_FULCIO
• INPUT_PRIVATE_SA (Signing authority)
• INPUT_PRIVATE_SIGNING
• INPUT_DISABLE_PGI (Public Good Instance)

and so on.