chore(deps): bump the ci group with 4 updates

Bumps the ci group with 4 updates: [dcarbone/install-jq-action](https://github.com/dcarbone/install-jq-action), [thollander/actions-comment-pull-request](https://github.com/thollander/actions-comment-pull-request), [anchore/sbom-action](https://github.com/anchore/sbom-action) and [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer).


Updates `dcarbone/install-jq-action` from 2.1.0 to 3.0.1
- [Release notes](https://github.com/dcarbone/install-jq-action/releases)
- [Commits](dcarbone/install-jq-action@v2.1.0...v3.0.1)

Updates `thollander/actions-comment-pull-request` from 2.5.0 to 3.0.1
- [Release notes](https://github.com/thollander/actions-comment-pull-request/releases)
- [Commits](thollander/actions-comment-pull-request@v2.5.0...v3.0.1)

Updates `anchore/sbom-action` from 0.16.0 to 0.18.0
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@e8d2a69...f325610)

Updates `sigstore/cosign-installer` from 3.5.0 to 3.7.0
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@v3.5.0...v3.7.0)

---
updated-dependencies:
- dependency-name: dcarbone/install-jq-action
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci
- dependency-name: thollander/actions-comment-pull-request
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/mend_scan.yaml

@@ -42,7 +42,7 @@ jobs:
         go-version-file: '${{ github.workspace }}/go.mod'
 
     - name: 'Setup jq'
-      uses: dcarbone/install-jq-action@v2.1.0
+      uses: dcarbone/install-jq-action@v3.0.1
       with:
         version: '1.7'
 
@@ -180,7 +180,7 @@ jobs:
 
     - name: Comment Mend Status on PR
       if: ${{ github.event_name != 'schedule' && steps.pr_exists.outputs.pr_found == 'true' }}
-      uses: thollander/actions-comment-pull-request@v2.5.0
+      uses: thollander/actions-comment-pull-request@v3.0.1
       with:
         message: |
           ## Mend Scan Summary: :${{ steps.report.outputs.status }}:

.github/workflows/release.yaml

@@ -98,9 +98,9 @@ jobs:
         mkdir -p output
         kustomize build ./config/default > ./output/install.yaml
     - name: Setup Syft
-      uses: anchore/sbom-action/download-syft@e8d2a6937ecead383dfe75190d104edd1f9c5751 # v0.16.0
+      uses: anchore/sbom-action/download-syft@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
     - name: Setup Cosign
-      uses: sigstore/cosign-installer@v3.5.0
+      uses: sigstore/cosign-installer@v3.7.0
     - name: Run goreleaser
       uses: goreleaser/goreleaser-action@v6
       with: