feat: npmjs sigstore tuf: use ValidFor.Start and ValidFor.End

[ramonpetgrave64]

The work in #731 retrieves the latest the signing key from the TUF root. There is metadata for a ValidFor.Start, and in the future there may be a ValidFor.End.

Consider ensuring that the current timestamp is between the start and end timestamps.

[ramonpetgrave64]

The keys in the TUF root has been rotated and now include an end date.

• sigstore/root-signing@6625c65

Newer attestations seem to be using the new key, and the older slsa-verifier v2.5.1 with the hard-coded key no longer works on these newer attestations.

• [e2e]: nodejs create main default slsa3  slsa-github-generator#4078 (comment)