docs: update signature verification for cosign v3 bundles

[FreyreCorona]

Update the signature verification article to reflect the Cosign v3 signing flow introduced in caddyserver/caddy#7674.

What changed

Cosign v3 replaces the detached signature (<artifact>.sig) and certificate (<artifact>.pem) files with a single unified bundle (<artifact>.sigstore.json) containing the signature, the Fulcio certificate, and the transparency log entry.

• Describe the new bundle file and how to extract the certificate from it (verificationMaterial.certificate.rawBytes) for inspection with openssl.
• Replace COSIGN_EXPERIMENTAL=1 cosign verify-blob with the v3 keyless flow, which enforces tri-leg verification (signature, certificate identity, and transparency log) in a single command using --bundle plus --certificate-identity and --certificate-oidc-issuer.
• Note that Cosign v3 no longer prints the Rekor UUID, and show how to obtain it via rekor-cli search instead.
• Fix typos along the way.

Assistance Disclosure: This was created with the assistance of opencode/big-pickle.

[mohammed90]

Please rewrite it with human touch. LLMs tend to obsess over the exact changes and gets hung on "with the Cosign v3" and "now that we're adopting Cosign v3".

Also, the steps don't apply to Caddy v2.6 because the signature file format is different.

Make it generic. "Cosign v3" is not the subject of this article. Verifying signatures is.