Add container cosign and verification

[cokeeffe]

Summary

Adds container build signatures using signstore's cosign

With an increase in side-channel attacks, in particular with artifact registries, signing container images is a must. Here we use the sigstore cosign to sign the container builds. We are using the public Fulcio server to provide verification of the short-lived OIDC and public key.

When pulling container images, local devs or cloud infra can verify the signatures to ensure container image integrity.

What Changed

• Install cosign action
• sign image using fulico public server
• verify signature using cosign verify - add details to GHA job summary including command to verify locally

Open Questions

• Currently using Fulcio's public server for Pk - do you want to provide your own Pk?
• Needs testing in this org/registry
• A process to verify locally pulled images needs to be determined (nerdctl with docker-compose maybe?) or a wrapper bash script.
• Production deployments unknown so cannot advise on that at this time