attest: force https for rekor client

For some reason this defaults to http, which results in the server
terminating the request (my guess is this was previously redirecting
http->https before). This changes forces the https scheme (hopefully
this isn't disruptive for non-public good instances, but we can revisit
other changes later if we need to).

internal/attest/attest.go

@@ -251,6 +251,7 @@ func (a *Attestor) signPayload(ctx context.Context, sha plumbing.Hash, b []byte,
 	tc := &rekorclient.TransportConfig{
 		Host:     rekorHost,
 		BasePath: rekorBasePath,
+		Schemes:  []string{"https"},
 	}
 	rcfg := rekorclient.NewHTTPClientWithConfig(strfmt.Default, tc)