policy: add HTTP PGP signature verification builtin

Add verify_http_pgp_signature Rego builtin for HTTP sources using
pgpsign with checksum-request/response flow through policy resolution.
Wire sourcemeta HTTP checksum request/response conversion and add tests.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

policy/types.go

@@ -41,11 +41,13 @@ type HTTP struct {
 
 	Checksum string `json:"checksum,omitempty"`
 
-	Signature         *PGPSignature      `json:"signature,omitempty"`
-	AttestationBundle *AttestationBundle `json:"attestationBundle,omitempty"`
+	checksumResponseForSignature *httpChecksumResponseForSignature `json:"-"`
 }
 
-type AttestationBundle struct{}
+type httpChecksumResponseForSignature struct {
+	Digest string `json:"-"`
+	Suffix []byte `json:"-"`
+}
 
 type Git struct {
 	Schema      string `json:"schema,omitempty"`