use bot name as namespace

[trz42]

Use the bot instance's name as the namespace when signing files. Both sign and verify steps are updated. The verification is also prepared to support additional options such as valid-before.

CI tests are adjusted and extended to cover new functionality.

Part of CI output (added tests):

Verifying the signature against allowed signers...
Checking principal: wrong_namespace_identity and namespace: CI
Couldn't verify signature: namespace does not match
Could not verify signature.
Error: No valid signature found.
Expected failure for wrong namespace
Verifying the signature against allowed signers...
Checking principal: expired_key_identity and namespace: ci
allowed_signers:1: key has expired: verify time 2025-03-14T21:23:43 > valid-before 2025-03-11T00:00:00
Could not verify signature.
Error: No valid signature found.
Expected failure for expired key

[ocaisa]

LGTM, tests catch all the expected behaviours (at least for the EESSI use case)