chore: update cosign from v2 to v3 (#3561)

* chore: update cosign from v2 to v3

Also do not import cosing into zli, as it doubles the bianry size
See: https://github.com/project-zot/zot/actions/runs/19506399474/job/55833719683?pr=3561

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

* chore: privileged-test should not depend on downloaded images

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

---------

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

pkg/common/common.go

@@ -30,6 +30,9 @@ const (
 	// reason used: to reduce zot minimal binary size (otherwise adds oras.land/oras-go/v2 deps).
 	ArtifactTypeNotation = "application/vnd.cncf.notary.signature"
 	ArtifactTypeCosign   = "application/vnd.dev.cosign.artifact.sig.v1+json"
+	// CosignSignatureTagSuffix is the suffix used for cosign signature tags (e.g., "sha256-digest.sig").
+	// Using constant to avoid pulling in cosign dependency.
+	CosignSignatureTagSuffix = "sig"
 )
 
 var cosignSignatureTagRule = regexp.MustCompile(`sha256\-.+\.sig`)