fix: don't warn about tag usage for cosign-generated references

[ricardbejarano]

Summary

Fixes #3995.

When signing a cosign-generated discovery tag — e.g. the sha256-<digest>.att reference returned by cosign triangulate ... --type attestation — ParseOCIReference printed:

WARNING: Image reference <repo>:sha256-abc123.att uses a tag, not a digest, to identify the image to sign.
    ...

That warning is misleading here: these tags are derived from an image digest, so they already pin to specific content, and the user is deliberately signing the attestation/signature/SBOM artifact rather than a mutable image tag.

Changes

• ParseOCIReference now skips the tag warning when the reference is one of cosign's own digest-derived discovery tags (sha256-<digest>.sig, .att, .sbom). Ordinary mutable tags still warn as before, and digest references continue to be silent.
• The suffix set reuses the existing ociremote.{Signature,Attestation,SBOM}TagSuffix constants so it stays in sync with cosign's tag scheme.
• Extended Test_ParseOCIReference with cases for each generated suffix (no warning) and a look-alike tag latest.att (still warns).

Notes

CHANGELOG.md is release-generated, so it is intentionally left untouched. No Go toolchain was available locally; relied on CI for go test/lint.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 38.54%. Comparing base (2ef6022) to head (7d47259).
⚠️ Report is 787 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/cosign/cli/signcommon/common.go	0.00%	12 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4967      +/-   ##
==========================================
- Coverage   40.10%   38.54%   -1.57%     
==========================================
  Files         155      209      +54     
  Lines       10044    12994    +2950     
==========================================
+ Hits         4028     5008     +980     
- Misses       5530     7276    +1746     
- Partials      486      710     +224     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[cmurphy]

I think the warning still applies here, since it is still a tag and so it still is mutable, right?