Sign Flagger container images with cosign

[stefanprodan]

This PR adds container image signing to the release workflow. After the next release, users will be able to verify Flagger images using cosign and Kyverno, e.g.:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-flagger-image
  annotations:
    policies.kyverno.io/title: Verify Flagger Image
    policies.kyverno.io/category: Cosign
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/minversion: 1.4.2
spec:
  validationFailureAction: enforce
  background: false
  rules:
    - name: verify-image
      match:
        resources:
          kinds:
            - Pod
      verifyImages:
      - image: "ghcr.io/fluxcd/flagger:*"
        key: |-
          -----BEGIN PUBLIC KEY-----
          MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEST+BqQ1XZhhVYx0YWQjdUJYIG5Lt
          iz2+UxRIqmKBqNmce2T+l45qyqOs99qfD7gLNGmkVZ4vtJ9bM7FxChFczg==
          -----END PUBLIC KEY-----     

The cosign keys are stored in Git, the private key password is stored as a GitHub secret and in FluxCD 1Password.