Support in-toto final product verification

Currently `in-toto-java` may be used by functionaries to generate and sign in-toto link metadata, as evidence for steps in the software supply chain.

This is a feature request to support full final product verification as described in section ["5.2 Verifying the final product"](https://github.com/in-toto/docs/blob/3d070aa2a87047d5afb79c1dde3dbc24493c11fe/in-toto-spec.md#52-verifying-the-final-product) of the in-toto specification.

See [`verifylib.in_toto_verify`](https://github.com/in-toto/in-toto/blob/v0.3.0/in_toto/verifylib.py#L1337-L1338) in the [reference implementation](https://github.com/in-toto/in-toto) and [`verifylib.InTotoVerify`](https://github.com/in-toto/in-toto-golang/blob/bc717bfe0503b4009ab5348de3e77369971b5bab/in_toto/verifylib.go#L741-L743) in the [golang implementation](https://github.com/in-toto/in-toto-golang) for two fully compliant examples.

Start with section 5.2, “Verifying the final product,” in the linked in-toto specification. Compare the behavior of verifylib.in_toto_verify in the Python reference implementation and verifylib.InTotoVerify in the Go implementation, then locate the corresponding verification entry point in in-toto-java. Done means full final product verification is supported in compliance with the specification.

Written by the indexing model from the issue text.