Signature is pushed without tag when using COSIGN_REPOSITORY

[yan]

Description

When using cosign sign with COSIGN_REPOSITORY set and attempting to sign an image in ECR, the signature is pushed without tag.

Example invocation:

COSIGN_REPOSITORY=image_signatures cosign sign -key me.key <account_id>.dkr.ecr.us-west-2.amazonaws.com/<image>:<tag>

The signature gets pushed to the proper repo, although the <sha>.sig tag is stripped.

More info
It looks like DestinationRef() in pkg/cosign/upload.go strips the tag when assembling the final URL.