Sign bundles with Cosign

[antgamdia]

As an improvement, we could start evaluating Cosign for signing our artifacts. We also have an issue in the main Kubeapps project for it, but perhaps it's easier to start in this repo?

See vmware-tanzu/kubeapps#4748 and https://carvel.dev/blog/signing-imgpkg-bundles-with-cosign/