Use specific user-agent

[jku]

This is a follow-up to #4406 that maybe got closed prematurely.

• Cosign should use a HTTP user-agent that includes the cosign version, This applies to requests to TUF, fulcio, rekor, TSA, dex
• Currently it (at least mostly) identifies as sigstore-go/$VERSION: ideally this would be cosign/$VERSION sigstore-go/$OTHER_VERSION

This likely requires some sigstore-go work to enable setting/extending the user agent.

[cpanato]

i will work on that