feat: add OpenTelemetry tracing support

[miyunari]

Summary

• Add client-side OpenTelemetry tracing with OTLP gRPC exporter
• New CLI flags: --tracing-enabled, --tracing-endpoint, --tracing-insecure, --tracing-stdout
• http.DefaultTransport wrapped with otelhttp.NewTransport for outbound call tracing
• Root spans created for sign and sign-blob operations
• Custom tracingTransport bridges span context for HTTP clients that create requests without context
• Uses shared tracing library from sigstore/model-validation-operator/pkg/tracing

Changes

• cmd/cosign/cli/options/root.go: Add tracing fields to RootOptions and persistent flags
• cmd/cosign/cli/commands.go: Add tracing init, transport wrapping, and shutdown
• cmd/cosign/cli/sign/sign.go: Add root span for sign operation
• cmd/cosign/cli/sign/sign_blob.go: Add root span for sign-blob operation
• internal/tracing/context.go: New file for ActiveCtx context bridge
• go.mod/go.sum: Add tracing dependencies

Test plan

• Verify build passes
• Run cosign sign --tracing-enabled --tracing-endpoint <collector> and verify traces in Jaeger
• Verify sign and sign-blob create connected spans to Fulcio/Rekor/TSA
• Verify no impact when tracing is disabled (default)