Rekor V2 as the default instance

[kommendorkapten]

Description

Plan out when to enable Rekor V2 as the default instance in the signing config.

Some details to consider:

• When was this enabled in cosign? In the past we have waited with breaking changes 6 months after the alst release of cosign with support
• When is the Java version being released with support?
• When is the JS version being release with support?

Once we have all these answered and documented and I think we are read for making the decision on when to enable it.

/cc @haydentherapper @bdehamer @loosebazooka

[haydentherapper]

cc @jku, cross-ref sigstore/rekor-tiles#548

Overall, we need to make sure we're not breaking verification for critical use cases, namely package registries.

Speaking for the Go ecosystem - we enabled signing config as the default for how to provide the list of services. Cosign v3 users will automatically pick up Rekor v2 once the URL is included in the TUF-distributed signing config.

Java support has been implemented, but we'll need to figure out the migration for Maven Central.

Note that Rekor v2 support is missing from sigstore-js and sigstore-ruby, but neither support the new signing config v0.2 format either so they won't unexpectedly break.