CI fails because of cryptography dependency conflict with sigstore

[lukpueh]

Tests fail because our sigstore dependency has a version constraint on cryptography. This has already been changed in sigstore but not yet release: sigstore/sigstore-python#1398

Originally posted by @lukpueh in #1002 (comment)

[jku]

CI doesn't fail in main right, only if we try to pin a new cryptography?

We could tell dependabot to ignore cryptography 45 for now... unfortunately there is no "ignore for a month" option