Tidy up features and dependencies

[dave-tucker]

Summary

While identifying the root cause of #436 I started looking into the features offered by sigstore such that I might avoid the dependency on tough entirely - it's marked as optional.

I attempted to use cargo-hack --every-feature to test whether the features compiled on their own.
Many features did not. You can reproduce this with:

cargo check --no-default-features --features oauth 
cargo check --no-default-features --features fulcio
cargo check --no-default-features --features cosign

I then tried cargo-hack --feature-powerset to test all combinations of features but it died due to OOM - too many feature combinations.

As such, I took a pass at trying to clean up the feature (and dependency) situation as follows:

1. Dependencies are specified using default-features=false and only
   the required features of dependencies are enabled. This avoids
   changes in downstream dependencies default feature-set bringing in
   new dependencies that we don't need.

2. I've audited all dependencies to ensure that just those required are
   included in each feature

3. All *-native-tls and *-rustls-tls features have been removed and are
   replaced with a single feature for each type of TLS. This correctly
   enables the right features in dependent packages but only if they
   have been selected by another feature (i.e cosign).
   This uses the ? operator added in Rust 1.60 but given
   this is over 2 years and 27 stable versions ago I doubt this will be an
   issue.

With these changes it was possible to add run cargo check in CI for:

• All features individually (with the exception of cosign, full, mock-client and registry which require a *-tls feature to compile
• All features combined with native-tls
• All features combined with rustls-tls

Then to run cargo test against --features full,native-tls and --features full,rustls-tls to ensure that both supported TLS options are properly tested.

Release Note

• The following features have been removed: full-native-tls,fulcio-native-tls,rekor-native-tls,cosign-native-tls,mock-client-native-tls,sigstore-trust-root-native-tls,registry-native-tls,full-rustls-tls,fulcio-rustls-tls,rekor-rustls-tls,cosign-rustls-tls,mock-client-rustls-tls,sigstore-trust-root-rustls-tls,registry-rustls-tls. These features have been replaced with native-tls and rustls-tls features. To migrate, simply replace full-native-tls with full, native-tls in your Cargo.toml

Documentation

No

[flavio]

Thanks for this contribution, this is something really interesting that I want to get merged. I'm currently traveling, I'll look closely at that next week

[viccuad]

LGTM, quite the cleanup, many thanks!
Learned about the ? operator, looking forward to other reviewers.

[flavio]

I like the PR, thanks a lot for the cleanup. I've left some minor requests

[flavio]

same here

[flavio]

@dave-tucker on top of my previous comments, could you also take a look at the Makefile and propagate some of the changes you did to the GitHub Action over there? It would be great to run at least some sanity checks locally before opening a PR

[dave-tucker]

@flavio all comments addressed and Makefile updated as requested.

[flavio]

Thanks for having done all the requested changes