Signature verification for custom plugins

[lahabana]

Problem Statement

The engineering brief in #371 covers paths for verifying signing plugins but it was intentionally removed from the scope.
This covers implementing a way to verify OCI images which are signed.

We need to decide if we support cosign, notary or both.

Proposed Solution

This brief: https://docs.google.com/document/d/1-gYEaf_31BR_QXmZXNhy0bOrXYJ4X_cXobQ_vbLDIhE/edit

Acceptance Criteria

• Decide which signing verification we support.
• A user can verify a signed OCI based plugin
• Documentation is added