Fix cosign sign-blob with --bundle flag for v3 compatibility

The recent update to sigstore/cosign-installer v4.0.0 installs Cosign v3,
which introduces a breaking change requiring the --bundle flag when using
cosign sign-blob. This fixes the CI failures in the static binary build jobs.

Signed-off-by: Sascha Grunert <[email protected]>

Author: saschagrunert

.github/workflows/ci.yml

@@ -95,6 +95,7 @@ jobs:
         run: |
           cd ${{ github.sha }}
           cosign sign-blob -y conmonrs \
+            --bundle conmonrs.bundle \
             --output-signature conmonrs.sig \
             --output-certificate conmonrs.cert
       - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
@@ -168,6 +169,7 @@ jobs:
         run: |
           cd ${{ github.sha }}
           cosign sign-blob -y conmonrs.${{ matrix.arch }} \
+            --bundle conmonrs.${{ matrix.arch }}.bundle \
             --output-signature conmonrs.${{ matrix.arch }}.sig \
             --output-certificate conmonrs.${{ matrix.arch }}.cert
       - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0