Bump cosign, fix breakage

[imjasonh]

$ go get -u github.com/sigstore/cosign
go get -u github.com/sigstore/cosign@latest
go: downloading github.com/sigstore/cosign v1.8.0
go: upgraded github.com/sigstore/cosign v1.3.2-0.20211120003522-90e2dcfe7b92 => v1.8.0
$ go get ./...
$ go mod tidy
$ go mod vendor
$ go build ./...
# github.com/google/ko/pkg/build
pkg/build/gobuild.go:351:20: undefined: types.CycloneDXMediaType

The const got renamed some time between 1.3.1 and 1.8.0: https://pkg.go.dev/github.com/sigstore/[email protected]/pkg/types

Fixes #713

Notably, some time between 1.3.1 and 1.8.0, the vendored cosign dependency seems to have grown by ~180k lines... 😒

[imjasonh]

Superceded by #667 which bumps even more deps.