Use downloaded cosign binary in release workflow

[twz123]

Description

This simplifies its usage, as Docker is not required. Also fixes the CURDIR issue:

/runner/_work/_temp/942db570-3c25-43c3-8cce-9dbabc9f9633.sh: line 2: CURDIR: command not found
docker: invalid spec: :/k0s: empty section between colons.
See 'docker run --help'.

Fixes:

• Signing k0s binaries with cosign  #3536

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

How Has This Been Tested?

• Manual test
• Auto test added

Checklist:

• My code follows the style guidelines of this project
• My commit messages are signed-off
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules
• I have checked my code and corrected any misspellings

[kke]

lgtm, if it doesn't work, just recreate the tag.