Keyless signing for artifacts produced using github actions

[ankitm123]

We are using private-public key pair to sign artifacts. This is good, but we can do better.
Key management is tricky, and if our private keys get exposed, then anyone can use that key and sign jx artifacts.

Cosign supports keyless signing: https://edu.chainguard.dev/open-source/sigstore/how-to-keyless-sign-a-container-with-sigstore/

It should fairly straightforward to implement this.

[ankitm123]

/assign @ankitm123 @osamamagdy

[ankitm123]

/cc @ankitm123 @osamamagdy