Sign artifacts

[rasmus]

• https://github.com/sigstore/cosign
• https://docs.sigstore.dev/certificate_authority/oidc-in-fulcio/#source-repository
• https://opentofu.org/docs/intro/install/standalone/#verify-the-file-integrity
• https://blog.saintmalik.me/keyless-signing-container-images-github-oidc/
• https://www.yahooinc.com/paranoids/scaling-up-supply-chain-security-implementing-sigstore-for-seamless-container-image-signing