Support for CirleCI

[fproulx-boostsecurity]

Question
Given that CircleCI finally added the ability to specific a custom audience https://circleci.com/docs/api/v2/index.html#operation/PatchOrgClaims . Does it mean that cosign should work now ? It appears though, that given they simply pass the the token as env var in the job (unlike GitHub, looks like there is currently no way for a job to dynamically craft a new token with custom audience). https://circleci.com/docs/openid-connect-tokens/#format-of-the-openid-connect-id-token

So my understanding, is that we can set it to either a static value sigstore or an array that contains sigstore.

Does fulcio support list of audiences ?

[haydentherapper]

Dup of #591