ci(deps): Update cosign

[ananos]

It seems that cosign has moved to a new format by default (in v3.x) so this breaks the way harbor translates the signature. Until this is fixed, we can still use the updated cosign binary but we need to keep the old format:

goharbor/harbor#22401 (comment)

[netlify]

✅ Deploy Preview for urunc canceled.

Name	Link
🔨 Latest commit	6cb186e
🔍 Latest deploy log	https://app.netlify.com/projects/urunc/deploys/690b1b5a062c0c0008cf0316

[ananos]

seems to work fine with ghcr.io: https://github.com/urunc-dev/urunc/actions/runs/18833170781

verification for arm64 & the manifest:

$ ~/.cosign/cosign verify ghcr.io/urunc-dev/urunc/urunc-deploy@sha256:d0b3e741c83f371cb698defbc813afd38055722d3cc552fd831f36391b9bf87e --certificate-github-workflow-repository urunc-dev/urunc --certificate-identity-regexp "https://github.com/urunc-dev/urunc/.github/workflows/build-latest.yml.*" --certificate-oidc-issuer "https://token.actions.githu
busercontent.com"

Verification for ghcr.io/urunc-dev/urunc/urunc-deploy@sha256:d0b3e741c83f371cb698defbc813afd38055722d3cc552fd831f36391b9bf87e --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The code-signing certificate was verified using trusted certificate authority certificates

[{"critical":{"identity":{"docker-reference":"ghcr.io/urunc-dev/urunc/urunc-deploy@sha256:d0b3e741c83f371cb698defbc813afd38055722d3cc552fd831f36391b9bf87e"},"image":{"docker-manifest-digest":"sha256:d0b3e741c83f371cb698defbc813afd38055722d3cc552fd831f36391b9bf87e"},"type":"https://sigstore.dev/cosign/sign/v1"},"optional":null}]


$ ~/.cosign/cosign verify ghcr.io/urunc-dev/urunc/urunc-deploy@sha256:6930c8e12e6fa1c527162213e0ce2f
69952ada441360751913d37177e673f6e5 --certificate-github-workflow-repository urunc-dev/urunc --certificate-identity-regexp "https://github.com/urunc-dev/urunc/.github/workflows/build-latest.yml.*" --certificate-oidc-issuer "https://token.actions.githu
busercontent.com"

Verification for ghcr.io/urunc-dev/urunc/urunc-deploy@sha256:6930c8e12e6fa1c527162213e0ce2f69952ada441360751913d37177e673f6e5 --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The code-signing certificate was verified using trusted certificate authority certificates

[{"critical":{"identity":{"docker-reference":"ghcr.io/urunc-dev/urunc/urunc-deploy@sha256:6930c8e12e6fa1c527162213e0ce2f69952ada441360751913d37177e673f6e5"},"image":{"docker-manifest-digest":"sha256:6930c8e12e6fa1c527162213e0ce2f69952ada441360751913d37177e673f6e5"},"type":"https://sigstore.dev/cosign/sign/v1"},"optional":null}]

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

This PR is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 15 days.