Bump sigstore, configure dependabot to bump it for us in future

[Tom-Willemsen]

Description of work

Add your own description here

To test

Which ticket does this PR fix?

Acceptance criteria

List the acceptance criteria for the PR

---

Code Review

• Is the code of an acceptable quality?
• Are there unit tests in place? Are the unit tests small and test the a class in isolation?
• Have the changes been documented in the release notes. If so, do they describe the changes appropriately?

Functional Tests

• Do changes function as described? Add comments below that describe the tests performed.
• How do the changes handle unexpected situations, e.g. bad input?
• Has developer documentation been updated if required?