add tssc concept to build

[raffaelespazzoli]

• decide on the tooling. Not sure what goes here, but there will be a need for an evidence/attestation wharehouse and a policy enforcer. I'd like to use sigstore and kiverno if they fit the bill.
• deploy the tooling. using gitops
• enhance the pipeline to use the tooling
• implement one policy to prove the concept, possibly an image signature verification.

[BillBensing]

We can start here -> https://github.com/ploigos-automated-governance/1-demo/blob/main/README.md

[BillBensing]

I can walk through how I think the implementation should look like.

[raffaelespazzoli]

as a first step, can we discuss what tools we need and how they are going to interact? Let's say for now that we want to sign images. and allow only signed images to be ran.