feat: pin cosign version (#606)

Signed-off-by: aerosouund <aerosound161@gmail.com>

Author: aerosouund

.github/workflows/release.yaml

@@ -47,6 +47,8 @@ jobs:
           cache-dependency-path: go.sum
       - name: Install cosign
         uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        with:
+          cosign-release: 'v2.6.0'
       - name: Install syft
         uses: anchore/sbom-action/download-syft@aa0e114b2e19480f157109b9922bda359bd98b90 # v0.20.8
       - name: Install ko