fix: upgrade cosign-installer to v4.1.1 for bundle v0.3 support

cosign v2.4.1 (from cosign-installer v3.7.0) cannot parse the new
sigstore bundle v0.3 format which uses a top-level "certificate"
field instead of "x509CertificateChain". Upgrading to v4.1.1
installs cosign v3.0.5 which supports the new format.

Author: kernel-kun

.github/workflows/krel-release-notes-validate.yaml

@@ -41,7 +41,7 @@ jobs:
         with:
           go-version: '1.23'
           check-latest: true
-      - uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
+      - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
         with:
           use-sudo: false
       - id: install-krel