Propagate error to Run resources

[lcarva]

Feature request

When Chains fails to process a TaskRun/PipelineRun for whatever reason, it adds the annotation chains.tekton.dev/signed with the value failed to the corresponding resource.

It would be beneficial to users/clients if they had some information about why signing failed. Let's introduce a mechanism that allows a user/client to view the failure reason without requiring access to the Chains controller logs.

Use case

Chains may fail to produce signatures and attestations for all kinds of reasons. Some of it may be due to an user error, e.g. failing to link the secret to the service account. As a regular user, without access to the controller, I want some visibility into why Chains failed to process my PipelineRun.