enhancement(ci): Sign release artifacts (#1959)

#### Description

<!-- Thank you for contributing Cerbos! Please describe the changes made
in this PR here and provide any other useful information for reviewers.
Make sure that you included some automated tests (e.g unit tests) to
verify your changes. If there is a requirement for user input for
testing, please include the instructions as well. -->
Signs release artifacts:
- binaries
- docker images

Fixes #<!-- Link the relevant issue here -->
#239

#### Checklist 

<!-- See
https://github.com/cerbos/cerbos/blob/main/CONTRIBUTING.md#submitting-pull-requests
for more information. -->

- [x] The PR title has the correct prefix 
- [x] PR is linked to the corresponding issue
- [x] All commits are signed-off (`git commit -s ...`) to provide the
[DCO](https://developercertificate.org/)

Signed-off-by: Piotr Solarczyk <psolarcz@cisco.com>

.github/workflows/release.yaml

@@ -9,6 +9,9 @@ jobs:
     name: Release Binaries
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -55,6 +58,11 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-go-
 
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3.1.1
+        with:
+          cosign-release: 'v2.1.1'
+
       - name: GoReleaser
         uses: goreleaser/goreleaser-action@v5
         with:

.goreleaser.yml

@@ -87,6 +87,18 @@ nfpms:
         dst: /etc/systemd/system/cerbos.service
       - dst: /var/cerbos/policies
         type: dir
+
+signs:
+  - cmd: cosign
+    args:
+      - sign-blob
+      - --yes
+      - --rekor-url
+      - https://rekor.sigstore.dev/
+      - "--output-signature=${signature}"
+      - "${artifact}"
+    artifacts: all
+
 dockers:
   - id: cerbos-amd64
     dockerfile: Dockerfile.cerbos
@@ -237,6 +249,18 @@ docker_manifests:
       - "docker.io/cerbos/cerbosctl:dev-amd64"
       - "docker.io/cerbos/cerbosctl:dev-arm64"
 
+docker_signs:
+  - id: sign-images
+    cmd: cosign
+    args:
+      - sign
+      - --yes
+      - --rekor-url
+      - https://rekor.sigstore.dev/
+      - "${artifact}"
+    artifacts: all
+    output: true
+
 brews:
   - repository:
       owner: cerbos