docs: Add how-to guide for verifying with Sigstore

[morri-son]

Description

Add a how-to guide to the OCM website for verifying OCM component versions signed with Sigstore.

Scope:

• content/docs/how-to/verify-with-sigstore.md (NEW)
  • Online verification with public key
  • Offline/air-gapped verification via trusted_root_json
  • Identity verification (issuer + SAN)

Done Criteria

• How-to exists on the website
• Covers online and offline verification
• Code reviewed by other team members

[morri-son]

added to #1060