Signing OCIR Images with Cosign and Kyverno verifyImages

Sign OCIR images by digest with Cosign and enforce at admission using Kyverno verifyImages on OKE, with OCI Vault Secrets managing the key passphrase.