Update go-tuf and sigstore/sigstore to non-vulnerable go-tuf version.

[dhaus67]

Summary

go-tuf has a vulnerability assigned: GHSA-66x3-6cw3-v5gj.

This has already been fixed within cosign as well as sigstore/sigstore.

Updated the go-tuf version as well as the sigstore version to point to the latest version that's not containing the vulnerable go-tuf one.

[dhaus67]

I've fixed the build issue, as the latest commit of sigstore/sigstore seems to introduce a breaking dependency.

[codecov-commenter]

Codecov Report

Merging #847 (43bdce3) into main (cc33a43) will increase coverage by 0.09%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##             main     #847      +/-   ##
==========================================
+ Coverage   46.32%   46.42%   +0.09%     
==========================================
  Files          60       60              
  Lines        5116     5116              
==========================================
+ Hits         2370     2375       +5     
+ Misses       2471     2467       -4     
+ Partials      275      274       -1     

Impacted Files	Coverage Δ
pkg/types/rekord/v0.0.1/entry.go	48.18% <0.00%> (+0.66%)	⬆️
pkg/types/alpine/v0.0.1/entry.go	55.78% <0.00%> (+1.23%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update cc33a43...43bdce3. Read the comment docs.

[bobcallaway]

lgtm