use an action to generate signed build provenance attestations for the built binary

[KEINOS]

To sign the built binary in the container ensures more security.

• https://github.com/actions/attest-build-provenance?tab=readme-ov-file
• Example

name: build-attest

on:
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      attestations: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Build artifact
        run: make my-app
      - name: Attest
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: '${{ github.workspace }}/my-app'