ci: attest build provenance for release artifacts

[ggbecker]

Description:

• Similar to what was done in: jan-cerny/openscap-throwaway@c8a18fd#diff-87db21a973eed4fef5f32b267aa60fcee5cbdf03c67fafdc2a9b553bb0b15f34R32-R36

      uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4
      with:
        subject-path: |
          build/openscap-*.tar.gz
          build/openscap-*.tar.gz.sha512

[openshift-ci]

@ggbecker: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	80d856c	link	true	/test e2e-aws-openshift-node-compliance
ci/prow/e2e-aws-openshift-platform-compliance	80d856c	link	true	/test e2e-aws-openshift-platform-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.