Sign the release checksums and container images with Cosign and GitHub OIDC

[stefanprodan]

We should use Cosign keyless signing (using GitHub Actions OIDC) to allow our users to verify the authenticity of Flux binaries, manifests, SBOM files and container images. Besides the the Flux artifacts, all the GitOps Toolkit controller images and release artifacts should also be signed in CI using GitHub Actions, Cosign and GoReleaser.

Projects:

• flux2
• source-controller
• kustomize-controller
• helm-controller
• notification-controller
• image-reflector-controller
• image-automation-controller
• source-watcher