feat: support providing the cosign public key via GitHub Secrets

[fyllus]

Summary

This removes the need to store cosign.pub in the repository by allowing the public key to be provided through GitHub Secrets.

The current approach can create unnecessary conflicts for forks and downstream repositories, since cosign.pub becomes a tracked file that must be replaced whenever a different signing key is used.

I encountered this while maintaining multiple repositories with independent signing identities. A cloned or forked repository required replacing cosign.pub, causing persistent diffs and potential merge conflicts unrelated to the actual code changes.

This change preserves full backward compatibility:

• If cosign.pub exists in the repository, the current behavior is unchanged.
• If the file is absent and cosign_public_key is provided, the action creates a temporary cosign.pub file during the workflow execution.

The implementation is intentionally minimal, requiring only:

• One optional input (cosign_public_key)
• A small conditional check before the build step

This allows forks, clones, and downstream repositories to use independent signing keys without modifying tracked files.

Backward compatibility: fully preserved.

This feature is optional and does not change the behavior of existing repositories that already track cosign.pub.

[HastD]

I'm not sure if this is a good idea; isn't it best practice to commit the public key to the repo? That way there's a public record of the public key that was used, which allows people to verify the signature on the images. (Otherwise, you'd have to provide the public key through some out-of-band mechanism like posting it in the readme or a separate website.) And for testing on a fork, you can just create a branch that uses a different cosign.pub.

As for the actual implementation, it looks correct aside from a couple minor issues, noted below.

[gmpinder]

I think this would be a reasonable addition so long as the backward compatibility is still a thing.