ci: sign checksum file with cosign

[dhth]

Hi. Thanks for maintaining yamlfmt!

I saw that the release artifacts aren't being signed. This PR adds the ability to sign the checksum file using cosign keyless signing. It's all done via goreleaser (which is also upgraded to version 2).

You can see this running in action here.

Not sure if signing release assets was on your roadmap, but if it was, hopefully this helps :)

---

I've also added instructions on how to verify the authenticity of the released assets to the README. Basically, the process looks like this (this is tweaked for my fork):

1. Download the following files from the release:

   curl -sfLO https://github.com/dhth/yamlfmt/releases/download/v0.13.5/checksums.txt
   curl -sfLO https://github.com/dhth/yamlfmt/releases/download/v0.13.5/checksums.txt.pem
   curl -sfLO https://github.com/dhth/yamlfmt/releases/download/v0.13.5/checksums.txt.sig
   

2. Verify the signature:

    cosign verify-blob checksums.txt \
       --certificate checksums.txt.pem \
       --signature checksums.txt.sig \
       --certificate-identity-regexp 'https://github\.com/dhth/yamlfmt/\.github/workflows/.+' \
       --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

3. Download the compressed archive you want, and validate its checksum:

   curl -sfLO https://github.com/dhth/yamlfmt/releases/download/v0.13.5/yamlfmt_0.13.5_Darwin_arm64.tar.gz
   sha256sum --ignore-missing -c checksums.txt

4. If checksum validation goes through, uncompress the archive:

   tar -xzf yamlfmt_0.13.5_Darwin_arm64.tar.gz
   ./yamlfmt

[dhth]

I removed the matrix strategy and set the version directly as the matrix array had a single element.

[braydonk]

Thank you for the PR! I am acknowledging that I have seen the PR, but due to some important work taking priority I won't be able to review until next week. Thanks for the contribution!

[braydonk]

Thanks for your patience, busy couple of weeks.

This is slightly new territory for me as I haven't had to set this up myself before. So I just had one question that I couldn't understand from my own searching. Just want to make sure I understand it for myself before accepting.

[braydonk]

Thank you for your contribution, this is a great feature!