[cosign] change over from exec to lib implementation

[dweomer]

Since the advent of https://github.com/ranchergovernment/carbide combined with hauler store sync --products functionality we, @amartin120 and I, had chosen to leverage our fork of https://github.com/hauler-dev/cosign via exec underneath the hood. We now wish to rescind this and move to leveraging our cosign fork as a library.

See also:

• https://github.com/google/go-containerregistry#partial

[dweomer]