ci: pin sigstore/cosign-installer to v4.1.2

The action does not publish a floating v4 major tag, so @v4 fails to
resolve and cancels every matrix leg of docker-publish at set-up.

Author: gustavosbarreto

.github/workflows/build-agent.yml

@@ -132,7 +132,7 @@ jobs:
           path: sbom-agent-*.cdx.json
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@v4
+        uses: sigstore/cosign-installer@v4.1.2
 
       - name: Attach SBOM to agent image
         run: |

.github/workflows/docker-publish.yml

@@ -65,7 +65,7 @@ jobs:
           path: sbom-${{ matrix.project }}-*.cdx.json
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@v4
+        uses: sigstore/cosign-installer@v4.1.2
 
       - name: Attach SBOM to '${{ matrix.project }}' image
         run: |
@@ -137,7 +137,7 @@ jobs:
           path: sbom-api-enterprise-*.cdx.json
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@v4
+        uses: sigstore/cosign-installer@v4.1.2
 
       - name: Attach SBOM to api-enterprise image
         run: |