Add pre-submit to verify base images

[ianlewis]

Adds a pre-submit to verify base images in all Dockerfiles in the repository.

• All base images must be referenced by digest.
• All images must be signed.
  • If the image name starts with "gcr.io/distroless/" then the image signature is verified using cosign with the distroless public key.
  • Otherwise the image is verified using Docker Content Trust and the image digest is verified.

NOTE: the "verify base images" workflow job needs to be added as a required status check to the protected branch rule after merging.

[ianlewis]

@joshuagl @laurentsimon I updated this to add a pre-submit script rather than instructions written in a comment. Please read the updated PR description.

[joshuagl]

This is fantastic, really nice work!

[ianlewis]

Added "verify base images" as a requirement on the protected branch rule.