feat: use digest to sign docker images/manifests

[caarlos0]

this drives it home by using the actual images/manifest digests to sign with cosign by default.

the default signing command is changing in this PR, but since digest should be always there (if not, the pipeline will fail way earlier), it should be fine.

refs #3496
refs #3540

[codecov]

Codecov Report

Merging #3556 (022eeb1) into main (ee6225f) will increase coverage by 0.00%.
The diff coverage is 100.00%.

@@           Coverage Diff           @@
##             main    #3556   +/-   ##
=======================================
  Coverage   83.66%   83.66%           
=======================================
  Files         116      116           
  Lines        9705     9706    +1     
=======================================
+ Hits         8120     8121    +1     
  Misses       1284     1284           
  Partials      301      301           

Impacted Files	Coverage Δ
internal/artifact/artifact.go	84.91% <ø> (ø)
internal/pipe/docker/docker.go	91.66% <ø> (ø)
internal/pipe/sign/sign.go	94.41% <100.00%> (+0.02%)	⬆️
internal/pipe/sign/sign_docker.go	100.00% <100.00%> (ø)

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.