feat: enhance "--insecure" option for stacker builds

[rchincha]

Add a stacker build --insecure so that when the build encounters a from: remote url, the build will proceed only if from signed/trusted sources. NOTE that insecure mode is currently the default, but we should move to secure by default and make insecure explicit.

The following options must be supported.

References:

docker trust inspect alpine:edge
https://github.com/docker/cli/blob/master/cli/command/trust/inspect.go#L22

https://github.com/sigstore/cosign

https://github.com/notaryproject/notation

[rchincha]

stacker already supports a insecure: directive

insecure should mean:

1. try https best effort - bad/unknown CA ignored
2. else fallback to http
3. also ignore signatures

Also, does this have to be a build arg on cmdline or in the stacker.yaml, or both?

stacker build --substitute INSECURE=true
...
insecure: ${{INSECURE}}

[rchincha]

Also, insecure: false by default

[smoser]

stacker already supports a insecure: directive

insecure should mean:

1. try https best effort - bad/unknown CA ignored
2. else fallback to http
3. also ignore signatures

That is a lot of things for one flag.
perhaps something more fine-grained?

I would also like to request that we avoid negative terms. Ie, i'd rather have the keyword 'secure' and it default to 'true' than 'insecure' and it default to 'false'. doulbe negatives just cause confusion.