switch signers to use io.FS abstraction

[g-k]

AJ asked in #782 (comment):

Is there verification of os.RemoveAll() running successfully within SignFiles?

and we don't test the side effects of signers that read and write to disk and S3.

It's important to test this to ensure the correctness of the apk2 and gpg2 signers that shell out and the contentsignaturepki signer that writes to S3.

Switching the signers to take generic reader and writer clients and operate on an io.FS implementation might make this easier. For example by embedding an input test fixture FS then diffing it against the output FS or recording operations on a mock FS implementation.