Refactor: remove `sigstore.hashes`, merge into `sigstore.models`

[woodruffw]

sigstore.hashes only contains a single API, which is a data model. It should probably be in sigstore.models instead.

This would be a breaking change, since it's an API rename. So we'd either need to do it in 4.x or include a backwards-compatible import.

[woodruffw]

Messed around with this a little, and it's going to be annoying due to all of the cyclical module dependencies it'll cause (due to things going from sigstore.hashes to sigstore.models). So we'll need to clean those up before doing the refactor here.