Add build attestation for library packages

[Copilot]

This PR adds build attestation to the continuous integration pipeline using GitHub's actions/attest-build-provenance action. Build attestations provide cryptographic proof of the build's provenance, enhancing supply chain security for the library's NuGet packages.

Changes Made

Updated .github/workflows/continuous.yml:

1. Added required permissions:

   • id-token: write - Required for OIDC token generation
   • attestations: write - Required for creating attestations

2. Integrated attestation step:

   • Added actions/attest-build-provenance@v1 action
   • Positioned after build process but before artifact upload
   • Configured to target all .nupkg files in the Artifacts directory

- name: 'Attest: Build Provenance'
  uses: actions/attest-build-provenance@v1
  with:
    subject-path: 'Artifacts/*.nupkg'

Benefits

• Supply Chain Security: Provides cryptographic attestations that can be verified by consumers
• Build Integrity: Creates tamper-evident records of what was built and how
• Compliance: Supports security frameworks that require build provenance
• Transparency: Enables verification of package authenticity and build environment

The implementation follows GitHub's recommended practices and requires no changes to the existing build process or artifact generation.

Fixes #9.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[coveralls]

Pull Request Test Coverage Report for Build 15927540542

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 100.0%

---

Totals
Change from base Build 15927062279:	0.0%
Covered Lines:	221
Relevant Lines:	221

---

💛 - Coveralls

[coveralls]

Pull Request Test Coverage Report for Build 15927540438

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 100.0%

---

Totals
Change from base Build 15927062279:	0.0%
Covered Lines:	221
Relevant Lines:	221

---

💛 - Coveralls

[Copilot]

Pull Request Overview

This PR integrates build attestation into the CI pipeline for enhancing supply chain security of the NuGet packages.

• Added additional workflow permissions (id-token and attestations)
• Integrated the attest-build-provenance action in the workflow to generate build attestations

Comments suppressed due to low confidence (2)

.github/workflows/continuous.yml:17

• [nitpick] Consider adding an inline comment explaining the need for the 'id-token: write' permission to clarify its role in OIDC token generation for attestations.

  id-token: write

.github/workflows/continuous.yml:40

• [nitpick] Adding a brief comment describing the purpose and positioning of the attestation step could help future maintainers understand its role in the CI pipeline.

      - name: 'Attest: Build Provenance'