Verify upstream cosign keys

[Venefilyn]

When the issue of cosign keys being rerolled in Bazzite I did not notice it at all due to using this template for my own spin https://github.com/Venefilyn/VeneOS/

We should add a step about verifying the upstream cosign keys. IIRC it is possible with cosign-installer

[xynydev]

This can be done with @EyeCantCU 's GitHub Action too:
https://github.com/EyeCantCU/cosign-action?tab=readme-ov-file#verify

[xlionjuan]

    steps:
      - name: Checkout Push to Registry action
        uses: actions/checkout@v4

      - uses: sigstore/[email protected] # Moved from bottom, and disable if PR

      - name: Verify
        shell: bash
        run: |
          set -oue pipefail
          echo "---Grep image name---"
          containerfile_path="./Containerfile"
          image=$(grep -i '^FROM' "$containerfile_path" | awk '{print $2}')
          echo "Image: "${image}""
          echo ""
          echo "Using Cosign to verify image..."
          cosign verify \
            --key https://raw.githubusercontent.com/ublue-os/bluefin/refs/heads/main/cosign.pub \
            "${image}"