feat: make image verifer plugins extensible

[bcressey]

Issue #, if available:
Related: bottlerocket-os/bottlerocket#4684

Description of changes:
Replace the hard-coded "notation" plugin with an extensible map. This allows additional plugins to be added by downstream builds, or at runtime by copying plugins to a host path.

Plugins can store a corresponding trust policy in the settings API, which must be a base64-encoded JSON blob. Although this is optional, registering the trust policy with the OS ensures that it is measured into the TPM2 device, making it visible for remote attestation. The JSON format ensures that the policy can be canonicalized at runtime, rather than requiring it to be provied in canonical form.

Testing done:

Verified that enabled can't be the name of a plugin:

bash-5.3# apiclient apply <<EOF
[settings.image-verifier-plugins.enabled]
trustpolicy = "eyJ0cnVzdGVkRGlnZXN0cyI6W119"
EOF
Failed to apply settings: Failed to PATCH settings from '-' to '/settings?tx=apiclient-apply-oUh6I9Nnfo7wmvYy': Status 400 when PATCHing /settings?tx=apiclient-apply-oUh6I9Nnfo7wmvYy: Json deserialize error: invalid type: map, expected a boolean at line 1 column 37

Verified that I can configure two other policies:

bash-5.3# apiclient apply <<EOF
[settings.image-verifier-plugins]
enabled = true

[settings.image-verifier-plugins.digestion]
trustpolicy = "..."

[settings.image-verifier-plugins.notation]
trustpolicy = "..."
EOF

bash-5.3# apiclient get settings.image-verifier-plugins
{
  "settings": {
    "image-verifier-plugins": {
      "digestion": {
        "trustpolicy": "..."
      },
      "enabled": true,
      "notation": {
        "trustpolicy": "..."
      }
    }
  }

Terms of contribution:
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[bcressey]

I've also verified that using this settings SDK, with no other changes to kits, still works for existing variants like aws-ecs-3 that have the earlier, Notation-only logic.

[bcressey]

Add fix from @ytsssun and test cases to confirm.

[ytsssun]

Approved assuming CI passed.