Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly

[nkreiger]

Summary

Implements this:

sigstore/sigstore#1619

---

It looks like the flag was also missing from the CLI ko.KeyOpts to set the fulcio flow explicitly. Should be 100% backwards compatible because the default was always an empty string.

Release Note

• Command Flag Addition - --fulcio-auth-flow to explicitly set the fulcio authentication flow
• API Addition, support for --fulcio-auth-flow=client_credentials as an authentication flow. Requires the Client ID and Client Secret.

Documentation

cosign sign --fulcio_url=<url> --fulcio-auth-flow=client_credentials --client-secret=<secret file> --client-id=sigstore

[codecov]

Codecov Report

Attention: Patch coverage is 0% with 9 lines in your changes are missing coverage. Please review.

Project coverage is 39.94%. Comparing base (2ef6022) to head (2acc28b).
Report is 39 commits behind head on main.

Files	Patch %	Lines
cmd/cosign/cli/options/fulcio.go	0.00%	3 Missing ⚠️
cmd/cosign/cli/fulcio/fulcio.go	0.00%	2 Missing ⚠️
cmd/cosign/cli/attest.go	0.00%	1 Missing ⚠️
cmd/cosign/cli/attest_blob.go	0.00%	1 Missing ⚠️
cmd/cosign/cli/sign.go	0.00%	1 Missing ⚠️
cmd/cosign/cli/signblob.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3578      +/-   ##
==========================================
- Coverage   40.10%   39.94%   -0.17%     
==========================================
  Files         155      155              
  Lines       10044    10087      +43     
==========================================
+ Hits         4028     4029       +1     
- Misses       5530     5584      +54     
+ Partials      486      474      -12     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[bobcallaway]

also, please rebase now that #3579 has merged.

[cpanato]

nice