Refactoring ideas

[woodruffw]

To avoid blowing up #937 even more, I'm listing these here for independent PRs:

• sigstore.verify.models.Bundle should really be sigstore.Bundle or sigstore.models.Bundle or similar, since it's used across sign/verify.
• sigstore.verify.models.VerificationResult and subclasses should all just live in sigstore.verify. The entire models.py file should probably go away.
• sigstore._internal.merkle should probably be folded into sigstore.transparency, since it's entirely an implementation detail for LogEntry verification. Same for sigstore._internal.rekor.checkpoint.

[woodruffw]

#959 will remove VerificationResult entirely, in favor of an exception-driven verify API.

[woodruffw]

Per #959 (comment): log_and_exit is maybe too clever, we should just spit out tracebacks directly for debugging in _cli.py.

[woodruffw]

#989 has revealed a circular import that would be fixed by simplifying paths like sigstore.verify.models, so I'm going to go ahead and do that.