Upgrade to sigstore 4.0.0

[hugovk]

Split out from https://github.com/python/release-tools/pull/283.

cc @sethmlarson, @woodruffw

The flow here is:

• run_release.py is run on the release manager's machine. That pops open the sigstore auth page, and fetches an identity token.
• The token is then put into a SIGSTORE_IDENTITY_TOKEN env var, for when the sigstore CLI is run by add_to_pydotorg.py on the downloads server, where the file signing happens.

I can also give this a demo run with 3.15.0a1 next week.

[sethmlarson]

I've asked the Sigstore Python maintainers what the effects of upgrading are for 4.0.0, it was not immediately clear to me what the backwards incompatible changes would mean for our users.

[ezio-melotti]

sigstore 4.1.0 has been released.