feat(dist): udpate to 0.16, enable github attestations

[ashleygwilliams]

This change updates the cargo-dist version and then enables the Github Artifact Attestations feature

[alilleybrinker]

Amazing! Also wow we were super out of date on our cargo-dist version. Thanks! Looks like the only thing you're missing is the DCO signoff on the commit. The following should solve it from the dev branch you're using:

$ git rebase HEAD~1 --signoff
$ git push --force-with-lease origin dist-16

Thanks @ashleygwilliams!