Allow users to override the trust root with --trusted-root

[woodruffw]

As in sigstore-go: --trusted-root FILE will override the default trust root discovery via TUF, allowing a user to substitute their own trust root (potentially for an internal Sigstore deployment, or for testing, etc.).

This will unify the current rats nest of flags for configuring custom Sigstore behavior: we'll be able to deprecate and eventually remove --rekor-url, --rekor-root-pubkey, --fulcio-url, --ctfe, and possibly some others. This in turn will allow us to close #324.

xrefs:

• https://github.com/github/sigstore-go/pull/4
• Add opt-in support for tests that include providing a custom trust root sigstore-conformance#101

[woodruffw]

Closing in favor of #821: this is now a semi-urgent action item, since the conformance suite needs this flag to (fully) pass.