[REQ] use github attest

[sozercan]

What kind of request is this?

None

What is your request or suggestion?

consider adding https://github.com/actions/attest-build-provenance and https://github.com/actions/attest-sbom

this is in addition to using cosign for signing images

Are you willing to submit PRs to contribute to this feature request?

• Yes, I am willing to implement it.