chore: pin cosign to v2.x (#1913)

Same as:
- chainguard-dev/melange#2213

Author: xnox

.github/workflows/build.yaml

@@ -37,6 +37,9 @@ jobs:
 
       - name: Setup cosign (needed in CI tests)
         uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        with:
+          # https://github.com/goreleaser/goreleaser/issues/6195
+          cosign-release: "v2.6.1"
 
       - name: Setup crane (needed in CI tests)
         uses: imjasonh/setup-crane@31b88efe9de28ae0ffa220711af4b60be9435f6e # v0.4

.github/workflows/release.yaml

@@ -91,6 +91,9 @@ jobs:
       # Cosign is used by goreleaser to sign release artifacts.
       - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
         if: steps.check.outputs.need_release == 'yes'
+        with:
+          # https://github.com/goreleaser/goreleaser/issues/6195
+          cosign-release: "v2.6.1"
 
       - uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         if: steps.check.outputs.need_release == 'yes'