fix: add registry credentials to instance component cosign

Instance cosign sign/attest were missing --registry-username,
--registry-password, and COSIGN_EXPERIMENTAL=1. Aligned with
supply-chain component's .sign_image pattern.