Standardizing user agent strings

[haydentherapper]

Description

We should have a standard format for user agents. We should also provide guidance for tools that use Sigstore SDKs, e.g. Cosign's UA should include both its version and sigstore-go's UA.

Not sure if this can be tested easily via conformance, if not, I'll move this issue to sig-clients.

cc @jku

[jku]

The one way I can think of testing this is to require the client executable file name to match the primary user agent (and/or add a action argument to set expected user-agent) -- this way e.g. a Go client developer would have to name their test client binary "Go-http-client" to pass without setting a custom useragent. This is not a great test but it would at least make the user-agent visible to client developers

However, testing for this would require entirely new test infra: a local TUF web server that sniffs user-agents (the TUF repo does not have to work, it just needs to be able to collect the user-agent). Not rocket science but we have nothing like that currently in the tests