Support other signature verification

[kate-goldenring]

This PR #590 adds support for verifying a shim using a checksum. RCM should also support signature verification. For example, the wasmtime shim can be verified with cosign by running

cosign verify-blob \
  --certificate containerd-shim-wasmtime-v1.pem \
  --signature containerd-shim-wasmtime-v1.sig \
  --certificate-identity https://github.com/containerd/runwasi/.github/workflows/action-build.yml@refs/heads/main \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  containerd-shim-wasmtime-v1