feat: release artifact attestations

[scop]

This adds GitHub artifact attestations for our release binary assets. Related to and kind of an alternative to #372, I suggest we start with this.

Future improvements would be providing attestations for Docker images as well, and to "upgrade" to SLSA level 3, but I think this is an ok start.

Sneak peek to the results are in my fork, https://github.com/scop/upcloud-cli/attestations

$ curl -fSslLO https://github.com/scop/upcloud-cli/releases/download/v0.0.1/upcloud-cli_0.0.1_linux_x86_64.tar.gz
$ gh attestation verify upcloud-cli_0.0.1_linux_x86_64.tar.gz --repo scop/upcloud-cli
Loaded digest sha256:6428c1709729e223a2b8627531330ac228230e9c94baa57d97021129b48c7f25 for file://upcloud-cli_0.0.1_linux_x86_64.tar.gz
Loaded 1 attestation from GitHub API

The following policy criteria will be enforced:
- Predicate type must match:................ https://slsa.dev/provenance/v1
- Source Repository Owner URI must match:... https://github.com/scop
- Source Repository URI must match:......... https://github.com/scop/upcloud-cli
- Subject Alternative Name must match regex: (?i)^https://github.com/scop/upcloud-cli/
- OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!

The following 1 attestation matched the policy criteria

- Attestation #1
  - Build repo:..... scop/upcloud-cli
  - Build workflow:. .github/workflows/publish.yml@refs/tags/v0.0.1
  - Signer repo:.... scop/upcloud-cli
  - Signer workflow: .github/workflows/publish.yml@refs/tags/v0.0.1

[scop]

Need to possibly adjust this, depending on which is the first release this becomes available with.