Signing: Support multiple rekor logs while signing

[jku]

Follow up from #1363:

• the signing config from the sigstore instance may now provide a "ServiceSelector" value that instructs the client to use multiple services
• we currently only support ANY, and for rekor pick the first compatible rekor instance only

We should support other service selector values and multiple rekor instances when signing, but this is not critical right now because:

• public good signing config likely will only have one rekor URL in foreseeable future (there will be a v1 and v2 but client is supposed to pick only one of those anyway)
• we also don't have a good story for more complicated verification policy -- how does client decide how many logs it needs?