ci: sign images with cosign

[kharf]

Summary by cubic

Sign container images with cosign in the release workflow to enable verification and provenance. Uses GitHub OIDC for keyless signing and signs all published tags across registries.

• New Features

  • Grant id-token: write in the release workflow for keyless signing.
  • Install cosign and run make sign after make publish.
  • Add sign Makefile target to sign main, -ubi, -fips, and config-reloader images across $(PUBLISH_REGISTRIES).

• Dependencies

  • Add sigstore/cosign-installer@v4.1.1.

^{Written for commit c8a52c7. Summary will update on new commits. Review in cubic}