Support creating PKI sigstore signatures

[mtrmac]

#2579 has added support for sigstore signatures with non-Fulcio certificates, but we don’t support creating them.

• Add something like signature/sigstore.WithPKICertificate (and still requiring WithPrivateKeyFile? and with a separate WithPKIIntermeciateCertificates? or just a single all-in-one call?)
• Add support for the above in signature/sigstore/cli
• And, possibly, add an end-to-end sign+verification test to the Skopeo repo