chore(deps): bump github.com/sigstore/cosign/v2 to github.com/sigstore/cosign/[email protected]

[DmitriyLewen]

Description

This PR bumps github.com/sigstore/cosign/v2 to actual github.com/sigstore/cosign/v3 (v3.0.3).

Cosign didn’t mention any critical or breaking changes, so upgrading shouldn’t cause any problems.

Fix vulnerabilities

github.com/sigstore/cosign/v2 uses vulnerable (CVE-2025-66564) github.com/sigstore/timestamp-authority.
https://github.com/openvex/discovery is also affected:

➜ git:(main) ✗ govulncheck -format openvex ./... | jq '.statements[] | select(.vulnerability.name == "GO-2025-4192")'
{
  "vulnerability": {
    "@id": "https://pkg.go.dev/vuln/GO-2025-4192",
    "name": "GO-2025-4192",
    "description": "Sigstore Timestamp Authority allocates excessive memory during request parsing in github.com/sigstore/timestamp-authority",
    "aliases": [
      "CVE-2025-66564",
      "GHSA-4qg8-fj49-pxjh"
    ]
  },
  "products": [
    {
      "@id": "Unknown Product",
      "subcomponents": [
        {
          "@id": "pkg:golang/github.com%2Fsigstore%[email protected]"
        }
      ]
    }
  ],
  "status": "affected"
}

But in github.com/sigstore/cosign/[email protected] sigstore bumped version of github.com/sigstore/timestamp-authority (to github.com/sigstore/timestamp-authority/[email protected]) - sigstore/cosign#4532