Fix cosign copy --only for signatures

[marcofranssen]

Summary

There is a bug in the cosign copy command for the deprecated flag, as well documentation is invalid for the CLI option.

See
https://github.com/sigstore/cosign/blob/main/cmd/cosign/cli/copy/copy.go#L192
requires to have value sig instead of sign.

Also aligned the option docs order to align with the order of the
example. https://github.com/sigstore/cosign/blob/main/cmd/cosign/cli/copy.go#L40

Release Note

Fixes the cosign copy command to have correct documentation and proper fallback implementation for the deprecated --sig-only commandline option.

Documentation

N.A.

[codecov]

Codecov Report

Attention: Patch coverage is 71.42857% with 4 lines in your changes missing coverage. Please review.

Project coverage is 36.35%. Comparing base (2ef6022) to head (ac48b3d).
Report is 226 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/cosign/cli/copy/copy.go	76.92%	3 Missing ⚠️
cmd/cosign/cli/options/copy.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3904      +/-   ##
==========================================
- Coverage   40.10%   36.35%   -3.76%     
==========================================
  Files         155      203      +48     
  Lines       10044    12819    +2775     
==========================================
+ Hits         4028     4660     +632     
- Misses       5530     7585    +2055     
- Partials      486      574      +88     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[cpanato]

can we add tests?

[marcofranssen]

I propose to do that in follow up pr. There have been historically 0 tests on this command.

[haydentherapper]

We recognize that much of cmd/ is untested but we should use this opportunity to improve coverage. I'd recommend adding tests for the changed function, and refactoring if needed so you can have a more testable function.

[marcofranssen]

Well I only have limited time, so don't want to blow up the scope of this PR. I'm just a happy user of cosign doing my contribution, trying to improve things that I can do in the limited amount of time I have. To refactor tests and such I need much more time which I don't have right now.

So I would appreciate at least the improvements in this PR can be merged.