* add xml & yaml format support

* add attributes to denote files that are generated so GH skips them on diffs

* update & improve pgp unit tests

If the HTTP fetch failed, the io.Pipe created to pass the response body to the
goroutines that compute the SHA256 hash and verify the signature would be leaked.

simplify upload command to reuse common PKI package across client & server

Without this, we miss the ---END block.

Some changes:
- import names (app -> api, logging -> log)
- Commands package (cmd -> app)

This also breaks the go module dependency on rekor-server.

This is the first step in code reorganization. This follows the patterns
from kubernetes/kubernetes - each binary gets a directory under cmd/.
The main.go file for each binary lives there.
The commands live under cmd//app.