feat(aqua): support cosign for the binary, not only for checksums

[risu729]

Aqua allows cosign verification for binaries, not only for checksums.
https://aquaproj.github.io/docs/reference/registry-config/cosign

Currently, only these two packages are using it without opts, which doesn't work now.
https://github.com/aquaproj/aqua-registry/blob/9b2b783bba5c1637a5982f7c51ccd9d85af0e737/pkgs/k0sproject/k0s/registry.yaml#L69-L75
https://github.com/aquaproj/aqua-registry/blob/main/pkgs/technicalpickles/envsense/registry.yaml#L82-L93

cosign.opts is no longer supported since #6332, but this PR doesn't do anything about it.

[Copilot]

Pull Request Overview

This PR extends cosign verification support to work directly on binary files, not just on checksums. Previously, cosign verification was only available for checksum files through the AquaChecksum struct.

• Adds cosign verification as a standalone step in the verification pipeline
• Introduces AquaCosign struct as a top-level package configuration option
• Updates merging logic to handle the new cosign configuration structure

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/backend/aqua.rs	Adds cosign verification step to the main verification pipeline and implements verify_cosign method
crates/aqua-registry/src/types.rs	Adds AquaCosign field to AquaPackage and updates merging logic for configuration overrides

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[jdx]

bugbot run

[risu729]

@jdx Any reasons for not using the sigstore-rs crate?

Sorry, I didn't notice it's already used.