feat: add cosign

[fzipi]

what

• add cosign to sign images
• per https://docs.docker.com/build/ci/github-actions/push-multi-registries/, just using the proper tags should push to both registries so we don't need to build twice

Fixes #96

[fzipi]

See https://github.com/coreruleset/modsecurity-crs-docker/actions/runs/7873757487/job/21481826636?pr=200 for metadata output used for cosign step.