Expose root-level validate-only helper for digest verification inputs

[VinnyBarton]

Context

While integrating the current main branch of github.com/shiftleftcyber/securesbom-verifier into sbom-signing-api, the new root API worked well for full digest verification through:

securesbomverifier.NewVerifier().VerifyDigest(input, key)

However, the root package does not currently expose a validate-only helper for digest verification inputs. Consumers that need to validate/decode digest verification requests before key lookup or before calling their own service layer still need to import the lower-level package:

github.com/shiftleftcyber/securesbom-verifier/services/digest

That leaves one bit of integration friction after adding the higher-level root API.

User Story

As a Go service integrator, I want a root-level validate-only helper for digest verification inputs so that I can validate request shape, base64 encoding, hash algorithm support, and decoded signature/digest bytes without importing lower-level internal service packages.

Suggested API Shape

One possible shape:

verifier := securesbomverifier.NewVerifier()
validated, err := verifier.ValidateVerifyDigestInput(securesbomverifier.VerifyDigestInput{
    KeyID:         keyID,
    HashAlgorithm: "sha256",
    Digest:        digestB64,
    Signature:     signatureB64,
})

Or a package-level helper:

validated, err := securesbomverifier.ValidateVerifyDigestInput(input)

The exact naming is flexible, but it should live in the root package and avoid requiring consumers to import services/digest directly.

Acceptance Criteria

• Root package exposes a validate-only digest verification helper.
• Helper accepts the existing root securesbomverifier.VerifyDigestInput type.
• Helper returns a root-exported validated result type, or another stable public type, containing decoded digest bytes, decoded signature bytes, and normalized hash algorithm.
• Helper preserves root-level digest error identities such as ErrInvalidKeyID, ErrInvalidHashAlgorithm, ErrInvalidDigest, and ErrInvalidSignature so callers can use errors.Is.
• README includes a short example for validate-only digest request handling.
• Existing full verification API, Verifier.VerifyDigest(...), continues to work unchanged.

Why This Matters

In sbom-signing-api, full digest verification can now use the root API, but validate-only behavior still requires a lower-level import. Exposing this at the root would make the verifier module feel complete as a production integration surface and reduce dependency on package layout details.