Attach provenance and SBOM attestations to published docker container

What the title says.

Signed-off-by: Juan Antonio Osorio <ozz@stacklok.com>

Author: JAORMX

.github/workflows/image-publish.yml

@@ -81,6 +81,8 @@ jobs:
           context: .
           platforms: linux/amd64,linux/arm64
           push: true
+          provenance: mode=max
+          sbom: true
           tags: ${{ steps.docker-metadata.outputs.tags }}
           labels: ${{ steps.docker-metadata.outputs.labels }}
           cache-from: type=gha