Bump sigstore/timestamp-authority to v2.0.3+ to fix CVE-2025-66564

[vdemeester]

Summary

CVE-2025-66564: Sigstore Timestamp Authority DoS via excessive OID or Content-Type header parsing.

Current State

• main: v1.2.9
• release-v0.42.0: v1.2.8
• release-v0.37.2: v1.2.2

Required

Bump github.com/sigstore/timestamp-authority to v2.0.3+.

References

• GHSA-4qg8-fj49-pxjh
• https://nvd.nist.gov/vuln/detail/CVE-2025-66564