chore(deps): bump the gha group with 2 updates (#1870)

Bumps the gha group with 2 updates: [fluxcd/flux2](https://github.com/fluxcd/flux2) and [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer).


Updates `fluxcd/flux2` from 2.4.0 to 2.5.0
- [Release notes](https://github.com/fluxcd/flux2/releases)
- [Changelog](https://github.com/fluxcd/flux2/blob/main/.goreleaser.yml)
- [Commits](fluxcd/flux2@v2.4.0...v2.5.0)

Updates `sigstore/cosign-installer` from 3.8.0 to 3.8.1
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@v3.8.0...v3.8.1)

---
updated-dependencies:
- dependency-name: fluxcd/flux2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gha
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gha
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/release.yaml

@@ -99,7 +99,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: install flux
-        uses: fluxcd/flux2/action@v2.4.0
+        uses: fluxcd/flux2/action@v2.5.0
       - name: Clone repo
         uses: actions/checkout@v4
       - name: Prepare
@@ -168,7 +168,7 @@ jobs:
           version: v0.16.0
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@v3.8.0
+        uses: sigstore/cosign-installer@v3.8.1
         with:
           cosign-release: "v2.2.2"