setup containers policy for ghcr.io/get-aurora-dev

[renner0e]

Prerequisite for

• integrate bcvk and do actual testing ublue-os/aurora#2622
• Improve our PR testing story ublue-os/aurora#2538

Even if we publish PR images to the registry they should still be signed.

A nice side-effect of this would also be that bootc images that ship our public keys could seamlessly switch over to signed images on this GitHub organization, in this fictitious scenario that universal blue collapses tomorrow for example.

We need the following key-pairs

• one we use for production /usr/lib/pki/containers/ghcr.io-get-aurora-dev.pub what we currently have as cosign.pub in this repo
• a production backup key in case the production one gets leaked, do not sign images with this anywhere, only ship the public key on systems (still needs to be created) /usr/lib/pki/containers/ghcr.io-get-aurora-dev-backup.pub
• a dedicated key for PR builds only to be used on ublue-os/aurora (still needs to be created)