Add sigstore support to verify signatures of plugins.

It would be great if krew integrates cosign.

This way upon plugin install krew can verify the signatures and transparancy logs of published plugins.

In the first releases we should make this optional for plugins to have signatures, but in the long run it would be good to enforce those signatures.