Include a new cosign public key to verify the images

[anujc25]

What this PR does / why we need it

• Include a new cosign public key to verify the images

Which issue(s) this PR fixes

Fixes #

Describe testing done for PR

# Clean cache to force plugin inventory image to be downloaded along with signature verification
$ rm -rf ~/.cache/tanzu/plugin_inventory

------------

$ tz plugin search
Some initialization of the CLI is required.
Let's set things up for you.  This will just take a few seconds.

[i] Refreshing plugin inventory cache for "projects.packages.broadcom.com/tanzu_cli/plugins/plugin-inventory:latest", this will take a few seconds.
[i] Reading plugin inventory for "projects.packages.broadcom.com/tanzu_cli/plugins/plugin-inventory:latest", this will take a few seconds.

Initialization done!
==
[i] Refreshing plugin inventory cache for "harbor-repo.vmware.com/tanzu_cli_stage/plugins/plugin-inventory:latest", this will take a few seconds.
[i] Reading plugin inventory for "harbor-repo.vmware.com/tanzu_cli_stage/plugins/plugin-inventory:latest", this will take a few seconds.
  NAME                  DESCRIPTION                                                                       TARGET           LATEST
  accelerator           Manage accelerators in a Kubernetes cluster                                       kubernetes       v1.9.0
  account               TMC account management for the organization                                       mission-control  v0.3.3
  ...

Release note

Include a new cosign public key to verify the images

Additional information

Special notes for your reviewer

[prkalle]

LGTM. Thanks

[marckhouzam]

Late but still LGTM