GHSA-CCXC-VR6P-4858 Improper Certificate Validation in Cosign

Impact Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and "keyless signing"...