Promote cosign to public API (and support bzlmod)

In #36 we introduced support for using the _cosign_ tool with the `cosign_attest` and `cosign_sign` rules. Both of those require a registered toolchain for _cosign_. The _cosign/repositories.bzl_ file defines the `cosign_register_toolchains` macro, but it remains difficult to use in a _WORKSPACE.bzlmod_ file. Ideally we would register a toolchain for _cosign_ in the _MODULE.bazel_ file like we do for _crane_.

In short, it would be good to be able to use _cosign_ as easily as we can the other tools integrated by this module.

Start with cosign/repositories.bzl, especially the cosign_register_toolchains macro, and compare how crane is registered from MODULE.bazel. Determine the bzlmod-facing registration path and verify that cosign_attest and cosign_sign can use it as easily as the other integrated tools.

Written by the indexing model from the issue text.