feat(carvel-dev/vendir): cosign config

[scop]

https://github.com/carvel-dev/vendir/releases

Check List

• Read CONTRIBUTING.md
  • Read OSS Contribution Guide
• All commits are signed
  • This repository enables Require signed commits, so all commits must be signed
• Avoid force push
• Install and execute the package and confirm if the package works well
• Execute cmdx s to scaffold code

[suzuki-shunsuke]

Thank you!