ci: turn off cosign's signing config alongside the bundle format (#11144)

Every image-signing job has failed since signing was added (#11129):

  must provide --new-bundle-format or --bundle where applicable with
  --signing-config or --use-signing-config

Cosign 3 turned on two defaults, not one. The action only disabled
--new-bundle-format to keep the .sig tag layout, but --use-signing-config
is still on, and cosign refuses that pairing because the signing-config
path has nowhere to write its verification material without a bundle.
Disabling it too falls back to the default Fulcio and Rekor URLs, the
same services the .sig layout always used. The verify step needs no
change: cosign verify looks for a referrer bundle first and falls back
to the .sig tag when there is none.

Generated with [Devin](https://devin.ai)

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.github/actions/sign-image/action.yml

@@ -25,7 +25,12 @@ runs:
         set -euo pipefail
         # The .sig tag layout: the OCI-referrer bundle cosign 3 writes by default
         # is not read by the Kyverno and policy-controller releases in use today.
-        cosign sign --yes --recursive --new-bundle-format=false $IMAGES
+        # Cosign 3 also defaults to --use-signing-config, which insists on a
+        # bundle for its output; turning it off falls back to the default
+        # Fulcio and Rekor URLs, which is all the .sig layout ever used.
+        cosign sign --yes --recursive \
+          --new-bundle-format=false --use-signing-config=false \
+          $IMAGES
 
     - name: Verify
       shell: bash