also make GOVERSION an environment variable

This runs against a running setup, and does a single upload of some node
data.

rekor server validation via custom type

This retargets #67 at main instead of openapi branch

* add xml & yaml format support

* add attributes to denote files that are generated so GH skips them on diffs

* add types unit tests

* explicitly ignore error from ValidateLeaf

* improve PGP unit test coverage (#58)

* update & improve pgp unit tests

* add types unit tests

* explicitly ignore error from ValidateLeaf

* use files instead of embedded strings

add log_proof impl

* first pass at code gen impl

Validate the swagger schema as part of CI.

Also add the "openapi" branch to CI.

Add missing "content" to the ProposedLogEntry definition.

first pass at openapi doc

* turn on gosec and resolve blocking issues

* update & improve pgp unit tests

Fix resource leak if HTTP fetch fails

Clear up the stuff we no longer use and add some basic files
for test purposes (integration tests / local developement)

If the HTTP fetch failed, the io.Pipe created to pass the response body to the
goroutines that compute the SHA256 hash and verify the signature would be leaked.

* README updates

Details on how to build the server and verify amendments

simplify upload command to reuse common PKI package across client & server

Code review feedback from #46.

Stop using form files, use HTTP bodies instead.

Marshal the JSON correctly in verify, and properly load keys.

Add a missing .Close() for canonicalizing PGP signatures.