Support specifying multiple registries in the trust policy

[FeynmanZhou]

From the trust policy spec, it requires users to specify a list of one or more fully qualified repository URIs in the registryScopes.

However, this requirement limits the verification scope to repository level and narrows the verification scenario. If users want to specify all repositories under multiple registries in the registryScopes, it will be inconvenient.

I would suggest extending the scope to registry level. It will enable users to specify not only repositories but also registries in the registryScopes.

For example:

"registryScopes": [
              "registry.acme-rockets.io",
              "wabbit-networks.io"
            ]

[yizha1]

Besides policies on registry level, it will be good to support policy on image level for more granularity, for example,

"registryScopes": [
              "registry.acme-rockets.io/software/net-monitor:v1",
              "registry.acme-rockets.io/software/net-logger:v2"
            ]

[rgnote]

Today there's a guarantee of exactly one applicable policy per artifact (global excepted), resolved as "exact repository match, else global, else fail." A registry-level entry inserts a middle tier, so that rule needs to become an explicit specificity ordering: a repository scope is more specific than a registry scope, which is more specific than global, and the most specific match wins. Combined with @yizha1's image-level suggestion, this generalizes to a single ladder i.e. image > repository > registry > global.

[rgnote]

@FeynmanZhou @yizha1

Do we have any appetite to address this issue? If yes, I have some spare cycles to contribute this week.

[yizha1]

Hi @rgnote I'm happy to review any spec updates on this, but not the code side.

[rgnote]

Thanks @yizha1
I raised the pull request #330