Add hints if required signatures can’t possibly exist

[mtrmac]

Currently, signature verification can fail with https://github.com/containers/image/blob/e3293eaa4a81a99f33d1fda1eb9495aec722043f/signature/policy_eval_signedby.go#L118 . That’s technically correct; overall the codebase could be more helpful if signatures can’t possibly be read:

• because the input transport does not support them at all
• (Because the image format does not support them?)
• because registry does not natively support them and no sigstore is configured.

Moving this information from the code that has it to the signature verification implementation should not break any existing ImageSource… implementations, so it might require some care or perhaps bundling with other API breaks.

[mtrmac]

With c/image/internal/private, we can add fields like this.