Sign Docker extensions by default using cosign

[Dentrax]

We (@developer-guy) thought that we can add cosign support in the boilerplate. Similar to how GitHub did for Action starter workflow. ¹ So that developers can sign their extensions (+ images) by default. Leveraging this gives your users confidence that the extensions they got from Docker's extension market was the trusted code that you built and published.

Furthermore, we can add a signed icon in the Docker Extension UI like how ArtifactHub did as follows:

cc @dlorenc @cpanato

Footnotes

1. https://github.blog/2021-12-06-safeguard-container-signing-capability-actions/ ↩

[gtardif]

Thanks, this is in our backlog. Indeed, this with a badge displayed can increase user confidence