* turn on gosec and resolve blocking issues

* update & improve pgp unit tests

Fix resource leak if HTTP fetch fails

Clear up the stuff we no longer use and add some basic files
for test purposes (integration tests / local developement)

If the HTTP fetch failed, the io.Pipe created to pass the response body to the
goroutines that compute the SHA256 hash and verify the signature would be leaked.

* README updates

Details on how to build the server and verify amendments

simplify upload command to reuse common PKI package across client & server

Code review feedback from #46.

Stop using form files, use HTTP bodies instead.

Marshal the JSON correctly in verify, and properly load keys.

Add a missing .Close() for canonicalizing PGP signatures.

Without this, we miss the ---END block.

fix docker-compose to actually build server and work

fix lint errors, turn on CI check

Move the rest of rekor-server over.

Some changes:
- import names (app -> api, logging -> log)
- Commands package (cmd -> app)

Move the Rekor types from server to this repo.

This also breaks the go module dependency on rekor-server.

Create a "cli" directory under cmd.

This is the first step in code reorganization. This follows the patterns
from kubernetes/kubernetes - each binary gets a directory under cmd/.
The main.go file for each binary lives there.
The commands live under cmd//app.

Implement upload command

Accept flags artifact-url,public-key, signature and validate GPG formatting and verify file signature

This change refactors client.go and file.go into an `app` package.

This will make it more easily consumed by rekor-ctl

Once this change is in, I will push rekor-ctl up and then look to
further refactor use of code already duped in rekor-server

Seems to work for Node right now. I haven't tested on linux.

Rename file namespaces to rekord

Simple fix for hardcoded filename