Refactor the cosign script.

[mattmoor]

This refactors the cosign script for distroless, so that the arguments are passed through from cloudbuild.yaml, and shifts where -key ... is passed to be in cloudbuild.yaml.

This is preparation to start also signing the distroless images with a "keyless" flow, once sigstore/cosign#652 lands and cosign 1.2 cuts.

[mattmoor]

Basically what I'm thinking is we'll just add another block in cloudbuild.yaml with:

- name: gcr.io/projectsigstore/cosign:v1.1.0@sha256:47bdf660ceadb5065aa05af62fd24b184db0fdcb34d5892247035dd0dd2d5c3f
  env:
  - PROJECT_ID=${PROJECT_ID}
  - COMMIT_SHA=${COMMIT_SHA}
  - REGISTRY=gcr.io
  - COSIGN_EXPERIMENTAL=true
  - GOOGLE_SERVICE_ACCOUNT_NAME=<THE SA WE WANT THINGS SIGNED WITH>
  entrypoint: sh
  args:
  - -c
  - ./cloudbuild_cosign.sh

[mattmoor]

Note to self (or whoever does it!) we should make sure the service account we choose uses ${PROJECT_ID} so that others can replicate builds with gcloud builds submit:

- GOOGLE_SERVICE_ACCOUNT_NAME=<THE SA WE WANT THINGS SIGNED WITH>