release: upgrade to latest cosign v3

[mathieu-benoit]

Follow up on #361, use new cosign bundle v3.

[github-actions]

Overview

Image reference	score-compose:latest	score-compose:latest
- digest	29f4e9270809	b7bc03784ac6
- tag	latest	latest
- provenance	7b52ede	8b5eeca
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	5.8 MB	5.8 MB (-6 B)
- packages	54	54

Policies (0 improved, 0 worsened)

Policy Name	score-compose:latest	score-compose:latest	Change	Standing
Default non-root user	✅	✅		No Change
No AGPL v3 licenses	✅	✅		No Change
No fixable critical or high vulnerabilities	✅	✅		No Change
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	✅		No Change
No unapproved base images	✅	✅		No Change
Supply chain attestations	✅	✅		No Change
Valid Docker Hardened Image (DHI) or DHI base image	⚠️ 2	⚠️ 2		No Change

Packages and Vulnerabilities (1 package changes and 0 vulnerability changes)

• ♾️ 1 packages changed
• 53 packages unchanged

Changes for packages of type golang (1 changes)

	Package	Version score-compose:latest	Version score-compose:latest
♾️	github.com/score-spec/score-compose	0.0.0-20260207193827-7b52edeea3fe+dirty	0.0.0-20260208151002-8b5eecabdd96+dirty