feat(ci): add SLSA build provenance attestation to Docker builds

[nexus49]

Summary

• Adds actions/attest-build-provenance@v4 to the shared job-docker-build-push.yml reusable workflow
• Produces SLSA-compatible build provenance attestations for all container images pushed to GHCR
• Attestation is pushed alongside the image via the OCI referrers API, making it discoverable by policy engines (Kyverno, Gatekeeper, Ratify) and gh attestation verify
• Uses continue-on-error: true so existing caller pipelines that haven't added attestations: write yet won't break

Follow-up required

Caller workflows (all operator/service pipelines) need to add attestations: write to their top-level permissions block for the attestation to succeed. Without it, the step will soft-fail and the image is still built, signed, and pushed as before.

Example change in caller pipelines:

permissions:
  contents: write
  id-token: write
  issues: write
  packages: write
  pull-requests: write
  attestations: write  # ← add this

Verification

After a caller adds attestations: write and merges a build:

gh attestation verify oci://ghcr.io/platform-mesh/<repo>/<image>:<tag> --owner platform-mesh

Ref: platform-mesh/backlog#229