this drives it home by using the actual images/manifest digests to sign
with cosign by default.
the default signing command is changing in this PR, but since `digest`
should be always there (if not, the pipeline will fail way earlier), it
should be fine.
refs https://github.com/goreleaser/goreleaser/issues/3496
refs https://github.com/goreleaser/goreleaser/pull/3540
Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
b55b9976c7