build(deps): bump github.com/sigstore/cosign/v2 from 2.4.1 to 2.6.2 in /tools

[dependabot]

Bumps github.com/sigstore/cosign/v2 from 2.4.1 to 2.6.2.

Changelog

Sourced from github.com/sigstore/cosign/v2's changelog.

v2.6.2

v2.6.2 resolves GHSA-whqx-f9j3-ch6m.

Changes

• Fix bundle verify path for old bundle/trusted root (GHSA-whqx-f9j3-ch6m) (#4624)
• bump sigstore deps to resolve build errors (#4619)

v3.0.3

Thank you for all of your feedback on Cosign v3! v3.0.3 fixes a number of bugs reported by the community along with adding compatibility for the new bundle format and attestation storage in OCI to additional commands. We're continuing to work on compatibility with the remaining commands and will have a new release shortly. If you run into any problems, please file an issue

Changes

• 4554: Closes 4554 - Add warning when --output* is used (#4556)
• Protobuf bundle support for subcommand clean (#4539)
• Add staging flag to initialize with staging TUF metadata
• Updating sign-blob to also support signing with a certificate (#4547)
• Protobuf bundle support for subcommands save and load (#4538)
• Fix cert attachment for new bundle with signing config
• Fix OCI verification with local cert - old bundle
• Deprecate tlog-upload flag (#4458)
• fix: Use signal context for sign cli package.
• update offline verification directions (#4526)
• Fix signing/verifying annotations for new bundle
• Add support to download and attach for protobuf bundles (#4477)
• Add --signing-algorithm flag (#3497)
• Refactor signcommon bundle helpers
• Add --bundle and fix --upload for new bundle
• Pass insecure registry flags through to referrers
• Add protobuf bundle support for tree subcommand (#4491)
• Remove stale embed import (#4492)
• Support multiple container identities
• Fix segfault when no attestations are found (#4472)
• Use overridden repository for new bundle format (#4473)
• Remove --out flag from cosign initialize (#4462)
• Deprecate offline flag (#4457)
• Deduplicate code in sign/attest* and verify* commands (#4449)
• Cache signing config when calling initialize (#4456)

v3.0.2

v3.0.2 is a functionally equivalent release to v3.0.0 and v3.0.1, with a fix for CI to publish signed releases in the new bundle format.

• Note that the --bundle flag specifying an output file to write the Sigstore bundle (which contains all relevant verification material) has moved from optional to required in v3.

... (truncated)

Commits

• 3ade80c Fix bundle verify path for old bundle/trusted root (#4624)
• c4e6a78 v2.6 branch - bump sigstore deps (#4619)
• 634fabe Bump sigstore-go, move conformance back to tagged release
• c5545ed Partially populate the output of cosign verify when working with new bundles ...
• e191024 bump go builder to use 1.25.1 and cosign (#4417)
• 37fbfc7 Require exclusively a SigningConfig or service URLs when signing (#4403)
• b1acaeb Add a terminal spinner while signing with sigstore-go (#4402)
• 2581dfd chore(deps): bump the gomod group across 1 directory with 8 updates (#4401)
• 11163ae Bump sigstore-go, support alternative hash algorithms with keys (#4386)
• 153df46 chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.42.0 (#4391)
• Additional commits viewable in compare view

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.