Update cosign installer action

[velll]

Cosign switched to downloading releases from github rather than the GCS bucket a few months ago:
sigstore/cosign-installer#126
Guess they finally took the bucket down

The old script fails to download the release now

% curl -sL  https://storage.googleapis.com/cosign-releases/v1.9.0/cosign-linux-amd64
<?xml version='1.0' encoding='UTF-8'?><Error><Code>AccessDenied</Code><Message>Access denied.</Message><Details>Anonymous caller does not have storage.objects.get access to the Google Cloud Storage object. Permission 'storage.objects.get' denied on resource (or it may not exist).</Details></Error>%                                                                         

The command from the new script works

% curl -sL https://github.com/sigstore/cosign/releases/download/v1.9.0/cosign-linux-amd64 -o cosign  

[cdupuis]

Please remove cosign.

[velll]

Will remove cosign step altogether