Don't sign images

Signed-off-by: yubiuser <github@yubiuser.dev>

.github/workflows/build-and-publish.yml

@@ -89,6 +89,8 @@ jobs:
         type=ref,event=tag
       meta-flavor: |
         latest=${{ startsWith(github.ref, 'refs/tags/') }}
+      # FIXME: GHCR does not support the referrers API and spams the registry with sha-tagged images when cosigned: https://github.com/docker/github-builder/issues/109
+      sign: false
     secrets:
       registry-auths: |
         - registry: docker.io