Support for insecure mode in verifier

[souleb]

cosign has a flag --allow-insecure-registry that set InsecureSkipVerify=true on in the underlying tls config. We would like to have another option that set the scheme to http the same ways crane does it with its insecure flag.

The primary use case is testing.

[developer-guy]

I can take over this one @dlorenc