Inherit container policy when doing a switch

I noticed that doing a `bootc switch` from a signed image results in switching to an unsigned image unless you explicitly pass `--enforce-container-sigpolicy`

Reproducible Example:
1. Given a status of `ostree-image-signed:docker://ghcr.io/ublue-os/bluefin:40`
2. `bootc switch ghcr.io/ublue-os/bluefin:39`
3. Do a status and it's `ostree-unverified-registry:ghcr.io/ublue-os/bluefin:39`

Passing the enforce flag works as expected. The use case is that when doing testing it's common to switch a bunch. I was digging for a regression and switching between daily builds in multiple VMs, and by the time I was done all my images were unsigned.

Not sure on what the UX should look like as I would guess there are other enterprise policy features that would need to be accounted for. But it would be nice if the signing was transparent unless there was an error, so I figured if you're on a signed image you'd want to stay on a signed image.

Start by reproducing the reported `bootc switch` sequence with a signed image, then trace the switch handling and its `--enforce-container-sigpolicy` behavior. Done means the policy inheritance and UX are defined and switching does not silently produce an unsigned image, while accounting for the other enterprise policy features mentioned in the issue.

Vom Indexierungsmodell aus dem Issue-Text verfasst.