Action Cache Verification

I want to split this issue from https://github.com/bazelbuild/remote-apis/issues/133 to discuss about improvements to Action Cache verification specifically.

As folks are already aware, Action Cache is a Key-Value store that maps a cache key (i.e, an Action's digest) to an Action Result message, which in turn points to the outputs of said action. Currently, there is no way to validate if the given Key-Value mapping is "correct". To put this differently, clients kinda have to "blindly" trust the content of the Action Cache, and server implementations often secure the Action Cache by enforcing write (UpdateActionCache) permissions to only trusted clients.

As the next major step for remote-api v2, I want to explore the solutions where we can increase the trust for Action Cache entries for multi-tenancy use cases.

Specifically, I want to enable a client to trust and use Action Cache entries created by a third party through verification. There are a few prior arts, such as:

1. Git commit signing
- https://git-scm.com/docs/gitformat-signature
- https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work

2. OCI container signing with SigStore
- https://docs.sigstore.dev/cosign/signing/signing_with_blobs/
- https://git-scm.com/docs/gitformat-signature

3. Nix packaging shared cache
- https://nix.dev/tutorials/nixos/binary-cache-setup.html#generate-a-signing-key-pair

4. Go Module Checksum database
- https://go.dev/ref/mod#checksum-database
- https://research.swtch.com/tlog
- https://github.com/google/trillian

5. Google OSS Rebuild
- https://github.com/google/oss-rebuild

Start with the Action Cache and UpdateActionCache concepts described in the issue, then review the linked prior art on signed commits, OCI signing, Nix caches, checksum databases, and OSS Rebuild. The issue does not name files or tests; done would require an agreed verification design for third-party Action Cache entries in multi-tenant use cases.

Written by the indexing model from the issue text.