fix(deps): downgrade sigstore/cosign to v2
What
Downgrade sigstore/cosign to v2.
This reverts commit 7a70e8f8 (!868 (merged)).
Why
Cosign v3 is not currently supported by goreleaser, which breaks all release jobs: https://github.com/goreleaser/goreleaser/issues/6195