Add action and extend current ones for artifacts attestations

[Frawless]

Type of change

• Enhancement / new feature

Description

This PR adds attestation action that improves security in our release workflows. It notably adds:

• provenance generation for artifacts in release tarball
• provenance generation for our images
• provenance generation for OCI Helm images

Users can then verify artifacts via GitHub CLI for example like:

gh attestation verify oci://quay.io/strimzi/kafka-bridge@sha256:a18f69854800edacb1a570e292e6792586ffe4c80ae69887535ef289ffd5e370 --owner strimzi

The attestation will be automatically added to every project that onboards to v2.2, however, attestation of product images and sboms has to be added manually as describe in the docs.

An example of run with attestation is available here https://github.com/Frawless/github-actions/actions/runs/29780645578 , I decided to not run it in ITs to simply not pollute attestation endpoint for our org. It can be evaluated and changed if needed.

Checklist

Please go through this checklist and make sure all applicable tasks have been done

• Update documentation
• Make sure all tests pass
• Try your changes inside a Kubernetes cluster, not just from unit tests
• AI assistance was used to create this PR (see the Strimzi AI policy)