fix: use correct Rekor URLs to activate privacy warning

[aaronlew02]

Summary

This change updates the Rekor public good instance privacy warning for sign and sign-blob to appear only when the Rekor public good instance is to be used.

Previously, ShouldUploadToTlog only checked KeyOpts.RekorURL, despite the fact that KeyOpts.RekorURL defaults to the public good Rekor URL even when a signing config is provided containing a different transparency log URL. Now, ShouldUploadToTlog instead checks the signing config created for users that do not provide one manually.

To make this work, the following refactors occur:

1. The constructed signing config no longer omits ko.RekorURL when --tlog-upload=false. NewSigningConfigFromKeyOpts no longer has a tlogUpload input, and the relevant logic has been extracted for after ShouldUploadToTlog is called.
2. That signing config is now constructed before (instead of after) ShouldUploadToTlog is called.

[codecov]

Codecov Report

❌ Patch coverage is 51.61290% with 15 lines in your changes missing coverage. Please review.
✅ Project coverage is 39.69%. Comparing base (2ef6022) to head (36d750d).
⚠️ Report is 823 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/cosign/cli/sign/sign.go	0.00%	10 Missing ⚠️
cmd/cosign/cli/attest/attest.go	0.00%	3 Missing ⚠️
cmd/cosign/cli/sign/sign_blob.go	60.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5054      +/-   ##
==========================================
- Coverage   40.10%   39.69%   -0.41%     
==========================================
  Files         155      207      +52     
  Lines       10044    13048    +3004     
==========================================
+ Hits         4028     5180    +1152     
- Misses       5530     7134    +1604     
- Partials      486      734     +248     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Hayden-IO]

#5055 for the linter fix

[Hayden-IO]

can you rebase?

[bobcallaway]

@Hayden-IO quick question: I thought you wanted a URL-based match when we were discussing in the other PR?

[Hayden-IO]

That shouldn't change, matching should still be based on URLs. The previous PR didn't account for the divergent codepaths between the Cosign signing API and the sigstore-go signing API, so it was only checking the --rekor-url flag value and skipping the URLs provided in the signing config. Now, the signing config is the source of truth, with it being populated from per-service flag values.