[eks] [request]: Sign release artifacts with Sigstore

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
I'd like all artifacts created for EKS to be signed with Sigstore so we can verify that they are what they say they are. This would align EKS with upstream Kubernetes which as of v1.24.0 is [using Sigstore for all release artifacts](https://blog.sigstore.dev/kubernetes-signals-massive-adoption-of-sigstore-for-protecting-open-source-ecosystem-73a6757da73).

**Which service(s) is this request for?**
EKS.

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
I'd like to be able to verify the EKS artifacts with the same tools as for upstream Kubernetes, other OSS projects and internal services; [Sigstore](https://www.sigstore.dev/) is the [OpenSSF](https://openssf.org/) solution for this.

**Are you currently working around this issue?**
n/a

**Additional context**
This is related to https://github.com/aws/containers-roadmap/issues/43 for storing the signatures.

**Attachments**
n/a

Start by reviewing the related signature-storage issue at https://github.com/aws/containers-roadmap/issues/43 and the request's Sigstore and upstream Kubernetes references. Define which EKS release artifacts are in scope and how verification should work; done means all requested artifacts are signed and verifiable with the same tools used for upstream Kubernetes.

Written by the indexing model from the issue text.