support signature bundle 0.3

[jku]

Other clients have been producing 0.3 bundles for a while now: It would be good to support them in sigstore-rs as currently sigstore-rs cannot verify bundles produced by sigstore-python.

proto: https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto#L111

The version update: sigstore/protobuf-specs#191

[wolfv]

Hey @jku I have been working on this and I am sending a series of PRs. You can check out my branch over at https://github.com/wolfv/sigstore-rs/tree/cms which implements v0.3 bundle support and passes the entire conformance suite :)

[wolfv]

There are now two alternative implementations that support v0.3 in Rust:

• https://github.com/jdx/sigstore-verification
• https://github.com/wolfv/sigstore-rust