Consider installing `cosign` and `goreleaser` binaries manually

[macedogm]

After investigating #289 and #292, we identified that the GHA's that install cosign and goreleaser might not do much besides only installing those binaries. We should investigate pulling them "by hand" and performing checksum validation in the pipeline. Additionally, add a workflow to keep them updated.