Modularize Cosign Class (Replace ORAS)

Considering ORAS is being removed and we are now using Cosign Attestations, we should modularize the Cosign class in upload_to_harbor.py and make it available for use throughout the pipeline (ex. scan-logic stage).

Acceptance Criteria:

• Move Cosign class from upload_to_harbor.py to a module
• Refactor/update/simplify cosign usage in upload_to_harbor.py
  • Scan-logic update contained in separate ticket: #670 (closed)