feat: sign release artifacts with cosign

[scop]

Sample results in my fork (do not mind the changelog, scroll down to assets): https://github.com/scop/golangci-lint/releases/tag/v0.0.0

https://goreleaser.com/customization/binary_sign/?h=cosign#signing-with-cosign

Fixes #2462

[scop]

Non-CI goreleaser release runs should likely be done with --skip sign in order to not break after we add this.

[scop]

I guess some docs how to verify downloads with cosign would not hurt. But we don't have any for verifying the sha256sums either, so not sure. #5806 contains changes for verifying in the installer script.

[CLAassistant]

All committers have signed the CLA.

[scop]

Rebased and switched to the new bundle format.

[ldez]

I don't forget this PR, but each time I look at it, I'm stuck with the same problems/questions.

1. Adding a new element inside the release process introduces a new risk of release failure.
2. The goreleaser configuration inside this PR is different than the suggested one, I don't know why, and I don't find clear references with this configuration.
   • https://goreleaser.com/customization/binary_sign/?h=cosign#signing-with-cosign
   • https://github.com/goreleaser/example-supply-chain/blob/main/.github/workflows/release.yml
   • https://github.com/sigstore/cosign

[scop]

Keyless cosigning is IME the currently prominent way to do things, and goreleaser's docs as well as others out there are just lagging behind.

The GitHub artifact attestations we'll hopefully have for > 2.7.2 will make this mostly redundant, so I don't intend to pursue this further.