v0.0.28

Changed

• Upgraded sigstore dependency to >=4.0.0. Since version 4.0.0,
  sigstore supports signing using the new Rekor v2 instance, which
  will become the default in the future. We force the version to 1,
  so any attestations created with pypi-attestations==0.0.28 will
  still contain Rekor v1 entries.
• Repository has been moved to the pypi GitHub org. The new URL
  is https://github.com/pypi/pypi-attestations.