build: bump sigstore from 1.4.0 to 1.9.0

build: bump sigstore from 1.4.0 to 1.9.0 #6480