Inherit container policy when doing a switch

I noticed that doing a `bootc switch` from a signed image results in switching to an unsigned image unless you explicitly pass `--enforce-container-sigpolicy`

Reproducible Example:
1. Given a status of `ostree-image-signed:docker://ghcr.io/ublue-os/bluefin:40`
2. `bootc switch ghcr.io/ublue-os/bluefin:39`
3. Do a status and it's `ostree-unverified-registry:ghcr.io/ublue-os/bluefin:39`

Passing the enforce flag works as expected. The use case is that when doing testing it's common to switch a bunch. I was digging for a regression and switching between daily builds in multiple VMs, and by the time I was done all my images were unsigned.

Not sure on what the UX should look like as I would guess there are other enterprise policy features that would need to be accounted for. But it would be nice if the signing was transparent unless there was an error, so I figured if you're on a signed image you'd want to stay on a signed image.