Sign release checksums with cosign keyless

[andrew]

Adds sigstore keyless signing to the release pipeline, matching git-pkgs/git-pkgs@0a82984.

The workflow gets id-token: write permission so cosign can exchange the GitHub OIDC token with Fulcio for a short-lived signing cert. No keys to manage. Releases will publish checksums.txt.sig and checksums.txt.pem alongside the binaries.

Bumped cosign-installer to v4.1.1 (the git-pkgs commit used v3.10.0).

Verify with:

cosign verify-blob \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp 'https://github.com/git-pkgs/proxy/.github/workflows/release.yml@refs/tags/v.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt