Validate Notary v2 signatures of upstream base images during build

Currently, ImageBuilder pulls external base images during the build without verifying their signatures:

https://github.com/dotnet/docker-tools/blob/9b94edafb9caedd3967fd5efe88a5ca270430353/src/ImageBuilder/Commands/BuildCommand.cs#L638-L666

We should add a signature verification step after pulling base images, using `notation verify` to validate that each image was signed before it is used in a build. Not all upstream images have Notary v2 signatures, so verification should be opt-in and enabled wherever signatures are available.