Bump cosign to v2.5.3 (#6204)

Follow the builder bump of 2025.09.0 and use cosign v2.5.3 for
Supervisor too.

Author: agners

.github/workflows/builder.yml

@@ -134,7 +134,7 @@ jobs:
         if: needs.init.outputs.publish == 'true'
         uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
         with:
-          cosign-release: "v2.4.3"
+          cosign-release: "v2.5.3"
 
       - name: Install dirhash and calc hash
         if: needs.init.outputs.publish == 'true'

.github/workflows/ci.yaml

@@ -348,7 +348,7 @@ jobs:
       - name: Install Cosign
         uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
         with:
-          cosign-release: "v2.4.3"
+          cosign-release: "v2.5.3"
       - name: Restore Python virtual environment
         id: cache-venv
         uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4

build.yaml

@@ -12,7 +12,7 @@ cosign:
   base_identity: https://github.com/home-assistant/docker-base/.*
   identity: https://github.com/home-assistant/supervisor/.*
 args:
-  COSIGN_VERSION: 2.4.3
+  COSIGN_VERSION: 2.5.3
 labels:
   io.hass.type: supervisor
   org.opencontainers.image.title: Home Assistant Supervisor