feat: Bump policy-fetcher v0.1.17, new sources.yml format

Consume new sources.yml format for authorized_sources.
Pull in sigstore plumbing, even if not consumed yet.

Author: viccuad