GoReleaser setting to sign blob

sign-blob.yaml

# signs the checksum file
# all files (including the sboms) are included in the checksum, so we don't need to sign each one if we don't want to
# https://goreleaser.com/customization/sign
signs:
- cmd: cosign
  env:
  - COSIGN_EXPERIMENTAL=1
  certificate: '${artifact}.pem'
  args:
    - sign-blob
    - '--output-certificate=${certificate}'
    - '--output-signature=${signature}'
    - '${artifact}'
  artifacts: checksum
  output: true