feat: docker buildx support --provenance option

[phuhung273]

Context

By default, docker buildx also add attestations as per OCI standard > breake current ECR - only need the Image. Details:

• aws_ecr_assets: produces invalid tasks by linking to empty "attestation" image layer aws/aws-cdk#30258
• (lambda): lambda.DockerImageFunction can not be used alongside containerd to utilize cache storage backends aws/aws-cdk#31548

Workaround

BUILDX_NO_DEFAULT_ATTESTATIONS=1 cdk deploy

Possible solution

With --provenance option, issue can be fixed without workaround

• I may be able to implement this feature request