Use a Factory to create signature verifiers at policy evaluation time (#165)

* Make verifiers composable

* fix: remove unused code and improve signature verification logic

* fix: simplify abstractions and renamed some things

* fix: improve tl interface.

* fix: sort out signer/verifier

test/testdata/local-policy-fail/policy.rego

@@ -23,7 +23,7 @@ atts := union({
 	provs("https://spdx.dev/Document"),
 })
 
-opts := {"keys": keys}
+opts := {"keys": keys, "skip_tl": true}
 
 statements contains s if {
 	some att in atts

test/testdata/local-policy-pass/policy.rego

@@ -23,7 +23,7 @@ atts := union({
 	provs("https://spdx.dev/Document"),
 })
 
-opts := {"keys": keys}
+opts := {"keys": keys, "skip_tl": true}
 
 statements contains s if {
 	some att in atts

test/testdata/local-policy/doi/policy.rego

@@ -22,7 +22,7 @@ atts := union({
 	provs("https://spdx.dev/Document"),
 })
 
-opts := {"keys": keys}
+opts := {"keys": keys, "skip_tl": false}
 
 statements contains s if {
 	some att in atts