fix: strip trailing whitespace from attached signature files/stdin

[pujitha24]

Motivation:
The linked report below describes a failure after detaching a
signature with cosign download signature ... | jq -r '.Base64Signature' > signature.sig and later re-attaching it on
another registry with cosign attach signature --signature signature.sig .... The reporter's own --verbose debug output shows
the OCI manifest annotation dev.cosignproject.cosign/signature on the
re-attached image literally contains the base64 signature value with
a trailing newline embedded in it, unlike the original signing
machine's copy. That newline comes from shell redirection after
jq -r; cosign's attach signature command stores whatever bytes it
reads from the --signature file or stdin verbatim, with no trimming.

Storing extraneous whitespace inside a signature annotation is a
real, demonstrated defect regardless of whether it fully explains the
"invalid signature when validating ASN.1 encoded signature" error the
reporter hit: Go's own base64 decoder tolerates embedded \r/\n and
decodes to the same bytes, so this alone would not necessarily
reproduce that exact failure, and the report's repro also mixed up
cosign download signature's JSON envelope for --payload, a separate
issue. This change fixes the annotation-pollution defect on its own
merits; it is not a claim that it resolves the full reported scenario
end-to-end.

Approach:
Trim leading and trailing whitespace from bytes read from a signature
file or stdin in signatureBytes() (cmd/cosign/cli/attach/sig.go)
before they are stored as the signature annotation. Base64 has no
whitespace in its alphabet, so trimming cannot remove meaningful
signature bytes. The literal-argument path is untouched.

Validation:

• go test ./cmd/cosign/cli/attach/... — added
  TestSignatureBytesTrimsTrailingWhitespace, which fails before this
  change (returned bytes include the trailing "\n") and passes after;
  verified this directly by stashing the fix and re-running the test.
  Also added TestSignatureBytesFileWithoutTrailingWhitespaceUnaffected
  confirming clean input is unaffected.
• go build ./... and go vet ./cmd/cosign/cli/attach/... pass.
• go test ./cmd/cosign/... passes (all subpackages).
• golangci-lint run ./cmd/cosign/cli/attach/... (v2.12.2, matching
  this repo's Dockerfile.golangci-lint) reports 0 issues.

Report: #4207
Signed-off-by: Pujitha Paladugu 10557236+pujitha24@users.noreply.github.com

Fixes #4207

[codecov]

Codecov Report

❌ Patch coverage is 57.14286% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 39.53%. Comparing base (2ef6022) to head (22603e0).
⚠️ Report is 823 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/cosign/cli/attach/sig.go	57.14%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5058      +/-   ##
==========================================
- Coverage   40.10%   39.53%   -0.57%     
==========================================
  Files         155      207      +52     
  Lines       10044    13037    +2993     
==========================================
+ Hits         4028     5154    +1126     
- Misses       5530     7150    +1620     
- Partials      486      733     +247     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.