feat(policy-devel): allow external policy references

[Piskoo]

This PR adds support for external http://, https://, chainloop:// policy sources to policy devel eval

Examples:

cl policy devel eval --policy https://raw.githubusercontent.com/chainloop-dev/chainloop/main/docs/examples/policies/quickstart/cdx-fresh.yaml --material sbom.json 
{
   "result": {
      "violations": [
         "SBOM created at: 2024-01-09T12:00:00Z which is too old (freshness limit set to 30 days)"
      ],
      "skip_reasons": [],
      "skipped": false
   }
}

cl policy devel eval --policy chainloop://sbom-ntia --material sbom.json
{
   "result": {
      "violations": [
         "missing author",
         "missing supplier for 'AES-256-GCM'",
         "missing supplier for 'ECDH'",
         "missing supplier for 'RSA-2048'",
         "missing supplier for 'SHA384'",
         "missing supplier for 'SHA512withRSA'",
         "missing supplier for 'TLSv1.2'",
         "missing supplier for 'google.com'",
         "missing unique identifier (PURL, CPE, SWID) for 'AES-256-GCM'",
         "missing unique identifier (PURL, CPE, SWID) for 'ECDH'",
         "missing unique identifier (PURL, CPE, SWID) for 'RSA-2048'",
         "missing unique identifier (PURL, CPE, SWID) for 'SHA384'",
         "missing unique identifier (PURL, CPE, SWID) for 'SHA512withRSA'",
         "missing unique identifier (PURL, CPE, SWID) for 'TLSv1.2'",
         "missing unique identifier (PURL, CPE, SWID) for 'google.com'",
         "missing version for 'AES-256-GCM'",
         "missing version for 'ECDH'",
         "missing version for 'RSA-2048'",
         "missing version for 'SHA384'",
         "missing version for 'SHA512withRSA'",
         "missing version for 'TLSv1.2'",
         "missing version for 'google.com'"
      ],
      "skip_reasons": [],
      "skipped": false
   }
}

[migmartri]

check if there is smth already on the way we parse the policies in the contracts

[migmartri]

we might want to make sure this is not mandatory, I mean, if you do not provide a connection, the command should still work with file:// or http://

[Piskoo]

It's not mandatory, we use it if it's available otherwise it works the same way as before and it will return jwt related error to the user for chainloop:// policies

[migmartri]

This is sweet, but is this a breaking change, in other words, would comments that used to provide a file path work out of the box?

[Piskoo]

This is sweet, but is this a breaking change, in other words, would comments that used to provide a file path work out of the box?
Do you need to provide file:// always now?

It works out of the box, file:// is optional, backwards compatibility is held by this fragment and that's the only reason we have to check for scheme.

[migmartri]

awesome, that makes sense.

[migmartri]

See my suggestion, thanks!

[migmartri]

I'd personally remove file://, and add examples for example

Suggested change

	cmd.Flags().StringVarP(&policyPath, "policy", "p", "policy.yaml", "Policy reference (file://, http://, https://, chainloop://)")
	cmd.Flags().StringVarP(&policyPath, "policy", "p", "policy.yaml", "Policy reference (./my-policy.yaml, https://my-domain.com/my-policy.yaml, chainloop://my-stored-policy)")