deps: bump sigstore from 2.2.0 to 3.0.0

[bdehamer]

Bumps the following dependencies:

• @sigstore/tuf from 2.3.4 to 3.0.0
• sigstore from 2.2.0 to 3.0.0

[reggi]

This only updates the pacote dep in one place and not for all package.json that have it as a dep. Do we want to update those as well?

[wraithgar]

pacote was already updated, this fixes the duping (for pacote at least) that started w/ the last npm 10 release.

Once this lands, the only outdated pacote in the tree will be a dev dep under template-oss

~/D/n/c/b/main (bdehamer/sigstore-3-0-0|✔) $ npm ls pacote --omit=dev
npm@10.9.0 /Users/wraithgar/Development/npm/cli/branches/main
├─┬ @npmcli/arborist@8.0.0 -> ./workspaces/arborist
│ ├─┬ @npmcli/metavuln-calculator@8.0.0
│ │ └── pacote@19.0.1 deduped
│ └── pacote@19.0.1 deduped
├─┬ libnpmdiff@7.0.0 -> ./workspaces/libnpmdiff
│ └── pacote@19.0.1 deduped
├─┬ libnpmexec@9.0.0 -> ./workspaces/libnpmexec
│ └── pacote@19.0.1 deduped
├─┬ libnpmpack@8.0.0 -> ./workspaces/libnpmpack
│ └── pacote@19.0.1 deduped
└── pacote@19.0.1

[wraithgar]

We also only keep the pacote ref in the cli itself up to date because that version is effectively "pinned" due to the bundled dependencies. The other packages don't need a new version every time we update pacote.