chore(deps): update dependency sigstore/cosign to v3

.gitea/workflows/release.yaml

@@ -16,7 +16,7 @@ jobs:
     steps:
       - uses: sigstore/cosign-installer@v4.0.0
         with:
-          cosign-release: "v2.6.2" # renovate: datasource=github-tags depName=sigstore/cosign
+          cosign-release: "v3.0.4" # renovate: datasource=github-tags depName=sigstore/cosign
 
       - uses: azure/setup-helm@v4.3.1
         with:
@@ -113,15 +113,23 @@ jobs:
         env:
           GITEA_REGISTRY_TOKEN: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
         run: |
-          for package in "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz"*; do
           curl \
             --fail \
             --show-error \
             --request POST \
             --user "${REPOSITORY_OWNER}:${GITEA_REGISTRY_TOKEN}" \
-              --upload-file "${package}" \
+            --upload-file "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz" \
               https://${GITEA_SERVER_HOSTNAME}/api/packages/${REPOSITORY_OWNER}/helm/api/charts
-          done
+
+          if [ -f "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz.prov" ]; then
+            curl \
+              --fail \
+              --show-error \
+              --request POST \
+              --user "${CHARTMUSEUM_USERNAME}:${CHARTMUSEUM_PASSWORD}" \
+              --upload-file "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz.prov" \
+                https://${GITEA_SERVER_HOSTNAME}/api/packages/${REPOSITORY_OWNER}/helm/api/prov
+          fi
 
       - name: Upload Chart to Chartmuseum (Helm)
         env: