Sign published container images

[andrew]

Adds keyless Cosign signing for published container images. Enables full provenance and SBOM attestations in Buildx, then verifies both are present in GHCR.

Closes #225

[acidghost]

LGTM!

You could also sign the SBOM as attestations: extract the SBOM and issue cosign attest over the file. I ended up updating my repo after opening the issue here 😅 (ref1, ref2). Downstream consumers might require the signature on the attestations before trusting the predicate (eg extractPayload from Kyverno).

[andrew]

Rebased onto main (picks up #230 multi-arch and #232 login-action bump; dropped the now-duplicate setup-buildx-action step). cosign sign now signs the manifest-list digest, and the attestation checks hold since .Provenance/.SBOM become per-platform-keyed objects.

Opened #236 to track cosign attest over the SBOM per @acidghost's suggestion — keeping this PR to image signing so it lands for v0.7.0.