Stabilize the bundle format

[woodruffw]

Per https://github.com/sigstore/sig-clients/issues/8: releasing a 1.0 version of the specs here would lend weight to cross-client standardization.

As part of that, we probably need a task burndown, along a few axes:

1. What isn't in the specs yet that needs to be?
2. What (breaking) changes to we want to make for a 1.0?
3. What other language bindings do we want to be ready with a 1.0?