feat: add notation policy init command

[ChrisJr404]

Adds notation policy init so new users can scaffold a valid trustpolicy.oci.json from flags instead of hand-writing one from the spec, which closes #653.

It follows the same shape as the existing notation blob policy init, so the flags and prompts should feel familiar. The differences are OCI-specific: there's no --global (OCI policy statements scope by registry rather than a global toggle), and there's a new --registry-scope flag that's repeatable and defaults to the wildcard "*" so a fresh policy applies to every registry until the user narrows it. The generated statement uses signatureVerification.level: strict. It runs OCIDocument.Validate() before writing, so a bad --trusted-identity DN or an illegal wildcard-plus-scope combination fails without touching the config. If a policy already exists it prompts before overwriting, and --force skips the prompt.

I updated specs/cmd/policy.md in the same PR since the discussion asked for the CLI spec to define the experience first. Happy to split the spec out into its own PR to land ahead of the code if that's the process you'd prefer.

Tested with go test ./cmd/notation/... (all pass). New init_test.go covers the happy path (file written, parses, validates, default wildcard scope), rejection of an invalid registry-scope combo, and --force overwriting an existing file. Also ran the built binary end to end against a throwaway XDG_CONFIG_HOME: default wildcard init, a --registry-scope variant, the overwrite prompt cancelling on N, and --force. One open question for reviewers: I left init non-interactive (flag-driven) to match the blob command; let me know if you'd rather it prompt for the trust store / identity when they're omitted.