Improve case of possible wrong instance on verify

[jku]

Fixes #1487

• moves rfc3161-client exception details to debug log level
• Offers a hint if TSA cert chain verification fails: this is a sign that possibly the bundle uses a different sigstore instance than the verification expects

$ sigstore verify identity ...
[16:09:18] WARNING  A certificate chain was not valid, are you using the correct Sigstore   _cli.py:1095
                    instance?
           ERROR    FAIL: sign-main-rekorv1/README.md                                       _cli.py:1098
$

[jku]

Maybe I went a little too far in removing details from the error putput. Could output one line of error details and then a separate hint

[jku]

Ok, I changed the output so there is a little more. This is what it looks like now if I try to verify a staging bundle without specifying --staging:

[14:35:50] WARNING  A certificate chain was not valid, are you using the correct Sigstore instance?       _cli.py:1096
           ERROR    FAIL: sign-main-rekorv1/README.md                                                     _cli.py:1100
           ERROR    failed to build timestamp certificate chain: unable to get local issuer certificate   errors.py:42
                    For detailed error information, run sigstore with the `--verbose` flag.  

--verbose will give you both the rfc3161 trace and and the sigstore-python trace

[woodruffw]

Makes sense to me, thanks @jku!