cosign: use binary from path

Description

If cosign is in path. use it instead of downloading a it