WIT-SVID: Add a witbundle package

[amartinezfayo]

Similarly to the jwtbundle and x509bundle packages, we need to add bundle support for the WIT-SVID profile.

[jsnctl]

Hi @amartinezfayo, I've put together a patch for what I understand the changes to go-spiffe might be here but I wanted to check my thinking before I open a PR against the repo main...jsnctl:jsnctl/wit-bundle

The bundle implementation herein is mostly a lift-and-shift and s/jwt/wit for jwtbundle -> witbundle. I think this is correct, as while obviously the WIT-SVID will be divergent from JWT-SVID, the format of the authorities in the bundle will be the same(?)

I've wrapped the jwtutils implementation in the case of witutils, and this could be done throughout if we wanted to avoid the duplication and greatly reduce the size of this diff.

[amartinezfayo]

Hey @jsnctl thank you for working on this!

the format of the authorities in the bundle will be the same(?)

Yes, that's correct. Both JWT-SVID and WIT use JWKS (RFC 7517) format for their signing keys. The WIT spec uses standard JOSE headers and the bundle stores the verification keys in the same format as JWT bundles.

I've wrapped the jwtutils implementation in the case of witutils, and this could be done throughout if we wanted to avoid the duplication and greatly reduce the size of this diff.

I think that's the right approach.

The patch is looking good. I think that you can open a draft PR and we can finish the review once spiffe/spiffe#327 is merged.