chore(mima): configure repository-specific cosign key (DCS-21)

[joshuasainzpalacios-mimacom]

Context

DCS-21 onboards function-kro into the Mimacom registry. This PR proposes a repository-specific, long-lived cosign keypair for function-kro instead of reusing the public key shared by the existing fleet.

The same keypair will sign v0.3.0, v0.2.1, v0.2.0 and future function-kro releases. This is not the per-release ephemeral-key implementation tracked separately in IDCS-7.

Changes

• Replace release/cosign.pub with the public half of the function-kro-specific keypair.
• Keep the private key and password only in the repository GitHub Actions secrets COSIGN_SIGNING_KEY and COSIGN_PASSWORD.
• Do not change the CI workflow or any upstream source code.

Validation

• Derived the public key from the private key and confirmed both public files are byte-identical.
• Confirmed the commit contains only release/cosign.pub and no private key material.
• Confirmed both GitHub Actions secret names exist; their values remain write-only.

Follow-up after merge

• Regenerate the function-kro patch series in crossplane-gitops.
• Open a separate catalog PR.
• Repeat the v0.3.0 dry-run before any real release.
• Verify the published image with the cosign.pub attached to its GitHub Release.

Non-goals

• No changes to signing keys used by other managed repositories.
• No per-release key generation or key rotation in this PR.