refactor: improve cosign signature/attestation lookup with oras

[Racer159]

Description

This improves the speed of cosign signature and attestation lookups using zarf dev find-images to encourage their use.

Testing against the Neuvector UDS Package registry1 variant more than halved the total find-images time:

This also aligns the authentication flow of this lookup with that of the image pull on create.

Related Issue

Fixes #N/A

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide Steps followed

[netlify]

✅ Deploy Preview for zarf-docs canceled.

Name	Link
🔨 Latest commit	d70cae6
🔍 Latest deploy log	https://app.netlify.com/projects/zarf-docs/deploys/6a22dc51b4136e000862ef37

[codecov]

Codecov Report

❌ Patch coverage is 62.06897% with 44 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/pkg/utils/oci_artifacts.go	68.96%	12 Missing and 6 partials ⚠️
src/pkg/packager/find_images.go	38.09%	9 Missing and 4 partials ⚠️
src/pkg/images/common.go	66.66%	7 Missing and 4 partials ⚠️
src/pkg/images/pull.go	50.00%	1 Missing and 1 partial ⚠️

Files with missing lines	Coverage Δ
src/pkg/images/pull.go	48.83% <50.00%> (-1.30%)	⬇️
src/pkg/images/common.go	60.08% <66.66%> (+1.05%)	⬆️
src/pkg/packager/find_images.go	56.94% <38.09%> (-1.01%)	⬇️
src/pkg/utils/oci_artifacts.go	57.50% <68.96%> (+3.65%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[brandtkeller]

Minor requests otherwise this is neat to see.

[brandtkeller]

lgtm. clean and effective - technically a breaking change (public function signature modification) but I believe we're intending to have the policy list utils as not within the boundary.

I haven't seen any requests for this logic to support non-https registries and the current approach is still an improvement over what was here previously. That was the only thing that stood out between pull.go and the implementation here.

[AustinAbro321]

LGTM, Thanks! I would love for find-images to rely entirely on oras-go instead of Crane. This is a good improvement for now

I am renaming this from chore-> refactor