Fix tags in image signatures and sboms attachments

[xopham]

• current cosign signatures only reference tags with "sha-..." tag and not the actual verstion or branch.
• sbom attachments are being deprecated and should be replaced by attestations:

WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.