deps: bump sigstore from 2.2.0 to 3.0.0

[bdehamer]

Bumps the following dependencies:

• @sigstore/tuf from 2.3.4 to 3.0.0
• sigstore from 2.2.0 to 3.0.0

[reggi]

This only updates the pacote dep in one place and not for all package.json that have it as a dep. Do we want to update those as well?

[wraithgar]

pacote was already updated, this fixes the duping (for pacote at least) that started w/ the last npm 10 release.

Once this lands, the only outdated pacote in the tree will be a dev dep under template-oss

~/D/n/c/b/main (bdehamer/sigstore-3-0-0|✔) $ npm ls pacote --omit=dev
[email protected] /Users/wraithgar/Development/npm/cli/branches/main
├─┬ @npmcli/[email protected] -> ./workspaces/arborist
│ ├─┬ @npmcli/[email protected]
│ │ └── [email protected] deduped
│ └── [email protected] deduped
├─┬ [email protected] -> ./workspaces/libnpmdiff
│ └── [email protected] deduped
├─┬ [email protected] -> ./workspaces/libnpmexec
│ └── [email protected] deduped
├─┬ [email protected] -> ./workspaces/libnpmpack
│ └── [email protected] deduped
└── [email protected]

[wraithgar]

We also only keep the pacote ref in the cli itself up to date because that version is effectively "pinned" due to the bundled dependencies. The other packages don't need a new version every time we update pacote.