Add cosign

[JPHutchins]

Examples:

• https://github.com/JPHutchins/envr/blob/d6880a90f88bff46b8f39696a82aa53af4029adc/.github/workflows/release.yml#L35-L50
• https://github.com/JPHutchins/python-distribution-example/blob/main/.github/workflows/release.yaml

Update README explaining how to use.