v0.9.0

Changes: see the v0.9.0 section of CHANGELOG.md.

Every release payload is listed in SHA256SUMS; it and each payload have a .sigstore.json signature bundle. The container images are named, by digest, in image-digests_v0.9.0.txt. How to check the signatures, the provenance and the SBOMs: docs/verifying-a-release.md.