ci: correct image input to sign command

[erikgb]

Closes

What changed?

Another fix to #4483. This tries to supply the full image digest to the cosign commands. Extract from the last attempt to sign the image on the main branch:

Generating ephemeral keys...
Retrieving signed certificate...
Successfully verified SCT...
WARNING: Image reference sha256:d611992eaadc602663757af08eba581126d6f518184fe66ec45198aba84cf7dd uses a tag, not a digest, to identify the image to sign.
    This can lead you to sign a different image than the intended one. Please use a
    digest (example.com/ubuntu@sha256:abc123...) rather than tag
    (example.com/ubuntu:latest) for the input to cosign. The ability to refer to
    images by tag will be removed in a future release.

Error: signing [sha256:d611992eaadc60266[37](https://github.com/weaveworks/weave-gitops/actions/runs/12722807382/job/35467266713#step:9:38)57af08eba581126d6f518184fe66ec45198aba84cf7dd]: accessing entity: GET https://index.docker.io/v2/library/sha256/manifests/d611992eaadc602663757af08eba581126d6f518184fe66ec45198aba84cf7dd: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:library/sha256 Type:repository]]
main.go:74: error during command execution: signing [sha256:d611992eaadc602663757af08eba581126d6f518184fe66ec45198aba84cf7dd]: accessing entity: GET https://index.docker.io/v2/library/sha256/manifests/d611992eaadc602663757af08eba581126d6f518184fe66ec45198aba84cf7dd: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:library/sha256 Type:repository]]

So it seems like the job is trying to sign a simple DockerHub image tag - with a digest format. 🤠

Also adding an additional echo command - to see if the docker action can provide this information.

Why was this change made?

Try to make image signing work.

How was this change implemented?

How did you validate the change?

Release notes

Documentation Changes

[tenstad]

Not 100% sure this works, we'll have to see :D LGTM!