Initial support for container verity image signing

[jiria]

Merge Checklist

• Followed patch format from upstream recommendation: https://github.com/kata-containers/community/blob/main/CONTRIBUTING.md#patch-format
  • Included a single commit in a given PR - at least unless there are related commits and each makes sense as a change on its own.
• Aware about the PR to be merged using "create a merge commit" rather than "squash and merge" (or similar)
• The upstream/missing label (or upstream/not-needed) has been set on the PR.

Summary

This PR adds a simple tool to generate signatures of root hashes of the dm-verity Merkle trees for all image layers in the container image. This will be used for mounting signed verity volumes.

This initial version was created as a fork of the genpolicy tool. Additional refactoring is desired to eliminate duplicate code and add tests.

Test Methodology

Manual validation.