sign Syft binary/container image via cosign

**What would you like to be added**:

A tool called `cosign`[^1] created and maintained by the `sigstore` [^2] community allows you to sign and verify container images. IINM `Syft` takes its releases via `GoReleaser,` luckily `cosign` is now integrated into `GoReleaser.`[^3]. Btw, there is a similar topic ongoing for the `ossf/scorecard` project too.[^4]

**Why is this needed**:

**Additional context**:
[^1]: https://github.com/sigstore/cosign
[^2]: https://sigstore.dev/
[^3]: https://carlosbecker.com/posts/goreleaser-cosign/
[^4]: https://github.com/ossf/scorecard/issues/309

cc: @luhring @wagoodman

Start by reviewing Syft's GoReleaser release configuration and the linked cosign and GoReleaser references. Done means Syft release binaries and container images are signed and can be verified with cosign.

Written by the indexing model from the issue text.