The identity has been changed[1] to also include the "CI config path"
and the ref path should be the git tag of the release.

Also remove `jq` as it is only nice to have, not needed and it masks the
return code of `cosign verify`.

[1] https://github.com/sigstore/fulcio/commit/a4b3e128c119123138889cf57bf65c4f3fae811a

Fixes: 8317be4d ("Sign the images with sigstore's fulcio/rekor")