We need to downgrade the version of cosign we are using, as this is blocking releases (see https://github.com/openfga/cli/actions/runs/19077645922/job/54497698890), causing it to fail with the following error:

Error: must provide --bundle with --signing-config or --use-signing-config

Root cause: goreleaser is not yet compatible with v3 of cosign (v3 announcement)

Solution for now, pin cosign to v2.x.

# ...
jobs:
  goreleaser:
    steps:
      # ...
      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
        with:
          cosign-release: "v2.6.1"
      # ...
# ...

Ref: goreleaser/goreleaser#6195