ci: add GitHub Artifact Attestations (build provenance)

[anotherGoogleFan]

Summary

This PR integrates GitHub Artifact Attestations (build provenance) into the release workflows.

As a security-sensitive project, the trustworthiness of released artifacts is critical. Provenance attestation attaches a cryptographically signed, verifiable proof of origin to each build artifact. Verifiers can confirm that the APKs were built by this repository, from a specific workflow and commit, inside GitHub-hosted Actions runners — not manually replaced or produced by an unknown build environment.

The recent Linux xz backdoor incident is a textbook example: the source code was clean, but the distributed pre-compiled binaries were poisoned. This illustrates that the trust chain doesn't end at the source code — it extends all the way to the actual built, packaged, and distributed artifacts. Provenance provides exactly this kind of "origin verifiability", helping downstream users confirm that what they received came from the expected official build pipeline.

Changes

• Added permissions: id-token: write, attestations: write, contents: write to BuildRelease and BuildPreRelease jobs
• Added actions/attest-build-provenance@v2 step after each build step to generate signed attestations for all output APKs

Verification

Once a release is built, anyone can verify an APK with:

gh attestation verify <apk-file> --repo MetaCubeX/ClashMetaForAndroid