What data is in scriptSig
scriptSig in a typical p2pkh scenario, which is the vact majority of bitcoin transactions, only contains the public key of the scriptPubKey hash as well as the signature. This means there's no metadata other than the public key and the signature for authorizing the payment.
For non-p2pkh transactions, such as for example p2sh transactions, more data is included in the scriptSig. For example in p2sh multisig, the multiple public keys capable of authorizing the multisig will be revealed. In even more complicated scripts, the scriptSig may reveal significant information, depending on what the scriptPubKey script is requesting. For example, there are snowflake transactions that require scriptSig to be solutions to certain puzzles. However, these transactions are very rare.
How transactions are validated
There are multiple security models in validating a transaction. Transaction validation is a different notion from transaction confirmation which you are talking about. Transaction validation asks whether a transaction is valid – for example, it is of the right format, it follows Kirchhoff's Law (i.e. sum of outputs is less than sum of inputs), and the outputs it spends have not been double spent. Validating a transaction requires access to the current UTXO.
Transaction confirmation on the other hand validates that a transaction has been buried under a certain amount of proof-of-work, for example k = 6 blocks. Checking the confirmation status of a transaction does not require traversing the whole data in the blockchain. It only requires looking at the blockchain headers. In the SPV security model, the transaction confirmation status is checked simply by checking that it was included in a block and buried under a certain amount of proof-of-work. This is done quickly without looking at the whole blockchain data (but just all of the blockchain headers) by providing a proof-of-inclusion which consists of Merkle tree path siblings.
