Spec: Replace .cosign with .sig in the suffix

[dlorenc]

See #214

We should do this before 0.3, maybe support both for a release then go back to just one for 0.4

[dlorenc]

I don't think we'll get to this in 0.3, but when we do it we should try to bump the version pinned here: https://github.com/sse-secure-systems/connaisseur/blob/feat/cosign/docker/Dockerfile#L15

[dlorenc]

Maybe we can support an env var for a release or two called "COSIGN_SUFFIX" to help out here instead of double writing.

[dlorenc]

Dual writing is probably the easiest thing for 0.3, it's not really a dual write, but a dual tag. triangulate can return just one though.

[dekkagaijin]

Here's the 2 sanest options I can think of:

1. Rip off the band-aid; new clients sign to and verify from the new location only.
2. Write to and verify from both tags for a time (1 release?). This allows for new clients to see signatures from old clients and vice versa.