Add the capability to verify the signature of sylva-units artifacts

Description

This MR adds support for OCI artifact signature verification in the Sylva Units Operator by introducing a verify field in the SylvaUnitsSource specification.

Changes

API Changes

• Added Verify field to SylvaUnitsSourcePreset structure
• Added CEL validation to ensure verify can only be set for OCI source types
• The verify field supports both Cosign and Notation providers

Controller Changes

• Modified GenerateOCIRepositories function to propagate verification configuration to Flux OCIRepository resources
• Both sylva-units and kustomize-units OCIRepository resources inherit the same verification configuration

Testing

• Added comprehensive unit tests for OCI repository generation with verification
• Added CEL validation tests for the verify field
• Tests cover: Cosign with secret, Cosign keyless (OIDC), Notation, and validation rules

Usage Examples

Using Cosign with a public key stored in a Secret:

apiVersion: unitsoperator.sylva/v1alpha1
kind: SylvaUnitsRelease
metadata:
  name: my-release
  namespace: my-namespace
spec:
  sylvaUnitsSource:
    type: oci
    url: oci://registry.example.com/sylva-units
    tag: v1.2.3
    verify:
      provider: cosign
      secretRef:
        name: cosign-public-keys

Using Cosign with keyless verification (OIDC):

apiVersion: unitsoperator.sylva/v1alpha1
kind: SylvaUnitsRelease
metadata:
  name: my-release
  namespace: my-namespace
spec:
  sylvaUnitsSource:
    type: oci
    url: oci://registry.example.com/sylva-units
    tag: v1.2.3
    verify:
      provider: cosign
      matchOIDCIdentity:
      - issuer: "^https://gitlab.com$"
        subject: "^https://gitlab.com/sylva-projects/.*$"

Using Notation:

apiVersion: unitsoperator.sylva/v1alpha1
kind: SylvaUnitsRelease
metadata:
  name: my-release
  namespace: my-namespace
spec:
  sylvaUnitsSource:
    type: oci
    url: oci://registry.example.com/sylva-units
    tag: v1.2.3
    verify:
      provider: notation
      secretRef:
        name: notation-certificates

Validation Rules

• The verify field is optional
• It can only be used with type: oci sources (enforced by CEL validation)
• The provider must be either cosign or notation (enforced by enum validation)
• Either secretRef or matchOIDCIdentity can be specified for Cosign (both are optional)

Dependencies

This feature requires:

• Flux source-controller API v1.2.0+ (already present in dependencies)
• Flux pkg/apis/meta package (added as dependency)

Related Issues

Closes #42 (closed)