SignedEntity calls `fn` on the signed entity and each of its constituent entities
(`SignedImageIndex` or `SignedImage`) transitively.
Any errors returned by an `fn` are returned by `Walk`.
Fn is the signature of the callback supplied to SignedEntity.
The oci.SignedEntity is either an oci.SignedImageIndex or an oci.SignedImage.
This callback is called on oci.SignedImageIndex *before* its children.