fix: signing has a different signature (#774)

<!-- markdownlint-disable MD041 -->
#### What this PR does / why we need it

Fixes an updated cosign usage
https://github.com/open-component-model/ocm-controller/actions/runs/19324494302

#### Which issue(s) this PR is related to
<!--
Usage: `Related to #<issue number>`, or `Related to (paste link of
issue)`.
-->

Signed-off-by: Gergely Brautigam <[email protected]>

Author: Skarlso

.goreleaser.yaml

@@ -40,11 +40,10 @@ signs:
   - cmd: cosign
     env:
       - COSIGN_EXPERIMENTAL=1
-    certificate: '${artifact}.pem'
+    signature: '${artifact}.sigstore.json'
     args:
       - sign-blob
-      - '--output-certificate=${certificate}'
-      - '--output-signature=${signature}'
+      - '--bundle=${signature}'
       - '${artifact}'
       - '--yes'
     artifacts: checksum