Provide way to download rekor public key from Sigstore TUF repository

[flavio]

Currently library end users have to provide the Rekor public key when creating a Cosign Client. This is required to verify the cosign bundles.

Having to specify the Rekor public key is needed when the default public Rekor instance is not used (e.g. for testing, air-gapped environments,...), however this is not what the majority of people will do.

It would be of great help to provide a some method that downloads the official Rekor public key from Sigstore's TUF repository. This is what cosign does behind the scenes.

[flavio]

We need a Rust library that implements TUF protocol in order to download the public key from Sigstore's TUF repository.

I think tough is a good candidate because it's considered stable and is well maintained.

However, I found some issues while trying to use it, I sent some patches upstream:

• Fix parsing of root.json file when ecdsa-sha2-nistp256 keys are used awslabs/tough#425
• Make ECDSA key parsing more flexible awslabs/tough#426

[flavio]

Currently blocked because of external issues on the tough crate

[flavio]

Quick update: the issue inside of tough seems to be slowly moving forward. In the meantime I have a branch which is implementing the retrieval of the keys from the TUF repository using the patched tough library.

I'll share more progresses later