ci: Harden workflows

[Saul-STFC]

Description

This PR adds CI Hardening to the stackablectl repo

This addresses all warnings from Zizmor and also bumps dependency versions.

NOTE: - sigstore/cosign-installer v3.9.1 → v4.1.2 : v3+ of Cosign has breaking changes to the default signature format, i'm not sure how that affects our registry/signing setup, so cosign-release is explicitly pinned to v2.6.5 for now rather than taking the installer's new default.

See:
https://github.com/sigstore/cosign/releases/tag/v3.0.1
https://blog.sigstore.dev/cosign-3-0-available/
goharbor/harbor#22592

Definition of Done Checklist

• Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
• Please make sure all these things are done and tick the boxes

Author

• Changes are OpenShift compatible
• CRD changes approved
• Helm chart can be installed and deployed operator works
• Integration tests passed (for non trivial changes)

Reviewer

• Code contains useful comments
• (Integration-)Test cases added
• Documentation added or updated
• Changelog updated
• Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

• Feature Tracker has been updated
• Proper release label has been added

[Saul-STFC]

@NickLarsenNZ @Techassi

[Techassi]

The changes themself are fine, but I think we should use the opportunity to improve the workflows in general. That is something which is on my plate since forever, but I just didn't get around to it yet.