Import cosign_checksum.txt for cosign release checksum bootstrap

[eshattow]

Tagged releases of sigstore/cosign have assets for many architectures that are lacking within sigstore/cosign-installer; Let's ease sigstore/cosign-installer being a gatekeeper of what architectures are allowed, and expand this to whatever upstream cosign supports.

Streamline the cosign version bump process by importing cosign_checksum.txt as a heredoc instead of as a curated version of it. Allows for straightforward updating and automates away the validate and bootstrap checksum variable maintenance for cosign version bump.

[eshattow]

Description of logic to implement:

We keep a configuration with the regex and associated substitution of the runner host for Operating System and for Architecture.
We keep a full copy of the cosign_checksums.txt

Starting with what we know about the runner host, look up the runner OS substitution and runner Arch substitution, and where no substitution is given then assume ascii_downcase of both what the runner host reports for OS and for Architecture.

If Host OS or Host Architecture are empty string then error as unsupported Host OS or unsupported Architecture.
If cosign_checksums.txt does not contain expected filename for runner OS substitution and runner Arch substitution, then error as executable binary not found in releases.

Apply any extras from configuration to override the default configuration.