feat(lab8): cosign sign + SBOM/provenance attestations + blob signing

[alileeeek]

Goal

Lab 8 submission: Juice Shop image signed with Cosign in local registry, SBOM from Lab 4 attached as attestation, provenance attestation added, and (bonus) tarball signed with cosign sign-blob.

Changes

• Added submissions/lab8.md with full verification outputs and explanations.
• Added labs/lab8/keys/cosign.pub — public key for verification.
• Added labs/lab8/results/ — verification outputs (excluded from commit per spec).

Testing

• Local registry running on localhost:5000
• Juice Shop signed with Cosign keypair
• cosign verify passes on original digest
• cosign verify fails on tampered (re-tagged alpine) digest
• SBOM attestation attached and verified (CycloneDX format)
• Provenance attestation attached and verified (SLSA v0.2)
• (Bonus) Blob signed with cosign sign-blob, tamper test fails correctly

Security

• Private key cosign.key is NOT committed (blocked by .gitignore)
• Only public key cosign.pub is committed for verification
• All verification outputs saved in labs/lab8/results/ (not committed per spec)

---

Task Checklist

• Task 1 — Image signed + tamper demo (both shown)
• Task 2 — SBOM + provenance attestations attached and verified
• Bonus — Blob signed + verify-blob success + tamper failure