build(): Sign releaser artifacts, not only container manifests

[JAORMX]

Description

The current goreleaser configuration leverages cosign to sign the
goreleaser container manifests using public sigstore infrastructure.
This is great!

This PR also signs the rest of the releaser artifacts (binaries, sbom
file, etc), so we can verify them using the aforementioned public
infrastructure. This is very useful for folks consuming the binaries
from the public GitHub releases.

Note that this assumes that the OIDC issuer is GitHub, and thus ties
this signature to be triggered a GitHub action.

Related issues

• Closes Provide signatures for binaries in releases #2788

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[knqyf263]

Thanks 👍