Advisories for Maven/Dev.sigstore/Sigstore-Java package

sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log