Verify image signature/attestation validity before consumption

[sbose78]

In strategies like source-to-image, it would be cool to verify the signature and provenance information of the builder image before proceeding with its execution.