Add signatures for keyless signing

[wata727]

See #1351

This PR adds the signatures for keyless signing when releasing a new version. GoReleaser has published an example of signging by cosign, which is used as a reference.
https://goreleaser.com/customization/sign/#with-cosign

In order to use GitHub Actions as an OIDC provider, the id-token permission is given. This will result in signing without manual authentication.

As far as I researched, cosign's keyless signing is an experimental feature, so added a warning to the README. For example, the following problems can be considered:

• The rekor.sigstore.dev and fulcio.sigstore.dev are operated on a best-effort basis and log entries may be reset without notice.
  • https://docs.sigstore.dev/rekor/public-instance
  • https://docs.sigstore.dev/fulcio/overview
• There is no way to verify the OIDC subject claim, so you cannot guarantee that it was signed in the workflow of this repository.
  • Verify certificate against job_workflow_ref string sigstore/cosign#1313