feat: blob sign command

[Two-Hearts]

This PR adds notation blob sign command with E2E tests.

It's an implementation of spec: https://github.com/notaryproject/notation/blob/main/specs/commandline/blob.md#notation-blob-sign

[codecov]

Codecov Report

Attention: Patch coverage is 93.17073% with 14 lines in your changes missing coverage. Please review.

Project coverage is 72.52%. Comparing base (fd00032) to head (d7e881c).

Files with missing lines	Patch %	Lines
cmd/notation/blob/sign.go	91.46%	11 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1128      +/-   ##
==========================================
+ Coverage   70.79%   72.52%   +1.72%     
==========================================
  Files          48       50       +2     
  Lines        2945     3126     +181     
==========================================
+ Hits         2085     2267     +182     
+ Misses        668      667       -1     
  Partials      192      192              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[JeyJeyGao]

LGTM with a suggestion.

[JeyJeyGao]

LGTM

[JeyJeyGao]

There 2 issues:

1. [FAIL] notation blob sign [It] with no permission to write the signature file: this test is failing randomly.
2. some files are generated during test in the repo. We should generate them in temp folders and delete them after testing.
   test/e2e/suite/command/blob/blobFile.cose.sig
   test/e2e/suite/command/blob/blobFile.jws.sig
   test/e2e/testdata/blob/blobFile.jws.sig
   @Two-Hearts

[shizhMSFT]

LGTM

[Two-Hearts]

2. some files are generated during test in the repo. We should generate them in temp folders and delete them after testing.
   test/e2e/suite/command/blob/blobFile.cose.sig
   test/e2e/suite/command/blob/blobFile.jws.sig
   test/e2e/testdata/blob/blobFile.jws.sig

@JeyJeyGao These files will not be generated in the repo when the e2e test is run on a GitHub runner, for example, in a PR build. If I choose to run make e2e at local as a developer, then I expect to see the resulted signatures in an E2E scenario. Just like in a real case, when I sign with Notation, I expect to see the signature right?

[JeyJeyGao]

2. some files are generated during test in the repo. We should generate them in temp folders and delete them after testing.
   test/e2e/suite/command/blob/blobFile.cose.sig
   test/e2e/suite/command/blob/blobFile.jws.sig
   test/e2e/testdata/blob/blobFile.jws.sig

@JeyJeyGao These files will not be generated in the repo when the e2e test is run on a GitHub runner, for example, in a PR build. If I choose to run make e2e at local as a developer, then I expect to see the resulted signatures in an E2E scenario. Just like in a real case, when I sign with Notation, I expect to see the signature right?

Running make e2e locally is an expected step for development. If we create some temporary files without deleting them, we have to manually delete them to maintain a clean git status, which is inconvenient for developers.

[Two-Hearts]

Running make e2e locally is an expected step for development. If we create some temporary files without deleting them, we have to manually delete them to maintain a clean git status, which is inconvenient for developers.

Makes sense. Updated all related test cases.

[JeyJeyGao]

LGTM

[shizhMSFT]

LGTM