feat: Add attestation entry point to Docker Images

[fabergat]

Description

This PR adds the support to the attestation verification in offline mode and give a suggestion on how to override the Docker entry point for Docker and Docker Compose.

Closes: #1310

Note:

The key material in trusted_root.jsonl does not have a built-in expiration date, so anything signed before you generate the trusted root file will continue to successfully verify. Anything signed after the file is generated will verify until that Sigstore instance rotates its key material, which typically happens a few times per year. You will not know if key material has been revoked since you last generated the trusted root file.

Open questions:

• Is this thing adding a lot more security?
• Is it worth it complicate the config?

Changes

Testing Information

Checklist:

• I have performed a self-review of my code
• My changes generate no new warnings
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[fdefelici]

Added few remarks.

I need also a clarification, to check if my undestanding is right about this need.
We are offering this attestation verification and related samples, to allow a user to create its own docker image with blockstack-cli and signer binary?

[fdefelici]

Rename this file entry_point.sh in order to match the entrypoint.sh file referred in the README.md

[fabergat]

done

[fdefelici]

Add hyperlink to the entry point file

[fabergat]

done

[fdefelici]

Add hyperlink to the entry point file

[fabergat]

done

[fdefelici]

Considering the section "Enviroment Variables", The description could be simplified in something like this:

The commands above:
1. **Set the environment variables**: `TAG`, `BUNDLE_PATH` and `TRUSTED_ROOT_PATH`
2. .... 

By this the message is still the same, but get rid off duplication respect of the "Environment Variables" section

[fabergat]

done

[fabergat]

Added few remarks.

I need also a clarification, to check if my undestanding is right about this need. We are offering this attestation verification and related samples, to allow a user to create its own docker image with blockstack-cli and signer binary?

We would like to enforce another small step that automate the process to verify the images source, the idea is to limit the the possibility to run unsigned software. To add to our signer plus the partners

[aldur]

Can you also modify the files under https://github.com/stacks-network/sbtc/blob/main/docker/mainnet/docker-compose.yml and the testnet corresponding version?