Upgrade to sigstore 4.0.0

[hugovk]

Split out from #283.

cc @sethmlarson, @woodruffw

The flow here is:

• run_release.py is run on the release manager's machine. That pops open the sigstore auth page, and fetches an identity token.
• The token is then put into a SIGSTORE_IDENTITY_TOKEN env var, for when the sigstore CLI is run by add_to_pydotorg.py on the downloads server, where the file signing happens.

I can also give this a demo run with 3.15.0a1 next week.

[sethmlarson]

I've asked the Sigstore Python maintainers what the effects of upgrading are for 4.0.0, it was not immediately clear to me what the backwards incompatible changes would mean for our users.

[ezio-melotti]

sigstore 4.2.0 has now been released.
There are also some security issues with sigstore 3.

[hugovk]

Rebased and resolved conflicts. sigstore is up to 4.4.0, but I've left this on 4.0.0 for now. Can update here or in a follow up.

[woodruffw]

I've asked the Sigstore Python maintainers what the effects of upgrading are for 4.0.0, it was not immediately clear to me what the backwards incompatible changes would mean for our users.

Sorry, not sure if I ever responded to this anywhere 😅

The short version is that there should be no compatibility concerns for users -- the major version here reflects a change to sigstore-python's public APIs, not to the format of the Sigstore bundles themselves.

[sethmlarson]

@woodruffw Amazing, thank you for confirming! Let's move forward with upgrading the Sigstore CLI then.

[sethmlarson]

LGTM

[hugovk]

Thanks! Will merge this as-is, and we can get hopefully back on the Dependabot train for newer 4.x.