Add support for verifying multiple artifacts

[malancas]

Summary

Closes #363

This adds support for verifying multiple artifacts against in-toto statement subjects. I added verify.WithArtifacts(artifacts []io.Reader) and verify.WithArtifactDigests([]ArtifactDigest).

To avoid creating nested for loops when checking for the presence of artifacts in the intoto statement, I utilized maps to store subjects stored in the statement by hash algorithm.

Release Note

Documentation

[codysoyland]

This looks great so far, nice work! I'll give it a more thorough pass when out of draft.

[steiza]

This looks great!

It would expand the scope of the pull request a bit, but I'm wondering if we should get rid of VerifySignatureWithArtifact and VerifySignatureWithArtifactDigest completely and just use VerifySignatureWithArtifacts and VerifySignatureWithArtifactDigests.

Technically those methods are part of a public API, but from some quick searching of various projects nobody is calling them directly (they're using things like WithArtifact and WithArtifactDigest to construct the policy).

Then we could also get rid of PolicyConfig options like verifyArtifact, artifact, verifyArtifactDigest, and artifactDigest.

What do you think? We'd have to update more files (like pkg/verify/fuzz_test.go) but I think it would actually simplify changes in other places. Just to be clear, we would retain WithArtifact and WithArtifactDigest as convenience functions.

[malancas]

This looks great!

It would expand the scope of the pull request a bit, but I'm wondering if we should get rid of VerifySignatureWithArtifact and VerifySignatureWithArtifactDigest completely and just use VerifySignatureWithArtifacts and VerifySignatureWithArtifactDigests.

Technically those methods are part of a public API, but from some quick searching of various projects nobody is calling them directly (they're using things like WithArtifact and WithArtifactDigest to construct the policy).

Then we could also get rid of PolicyConfig options like verifyArtifact, artifact, verifyArtifactDigest, and artifactDigest.

What do you think? We'd have to update more files (like pkg/verify/fuzz_test.go) but I think it would actually simplify changes in other places. Just to be clear, we would retain WithArtifact and WithArtifactDigest as convenience functions.

That sounds good for me. Should be easy to update tests. I'll keep WithArtifact and WithArtifactDigest intact.

[steiza]

LGTM!