feat: Add Artifact attestation for CI builds

[fabergat]

Description

Add Artifact attestation for CI

Closes: #1233

Ref: https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds#generating-artifact-attestations-for-your-builds

Changes

• Add Github Artifact Attestation in the docker build workflow

Testing Information

https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds#generating-artifact-attestations-for-your-builds

Checklist:

• I have performed a self-review of my code
• My changes generate no new warnings
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[aldur]

Before merging I'd like to see and verify an attested build, is it possible?

[fabergat]

Before merging I'd like to see and verify an attested build, is it possible?

https://github.com/stacks-network/sbtc/attestations/4526596

Before merging I'd like to see and verify an attested build, is it possible?

sure here https://github.com/stacks-network/sbtc/attestations/4526596
https://search.sigstore.dev/?logIndex=163916019
https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds#verifying-artifact-attestations-with-the-github-cli

[aldur]

Verified with the following:

gh attestation verify oci://index.docker.io/blockstack/sbtc:signer-test-attestation -R stacks-network/sbtc
Loaded digest sha256:3f7fd67e2d8ce754ce5890716d94da9fb09327f06ac17acdbc90e5735d0adb09 for oci://index.docker.io/blockstack/sbtc:signer-test-attestation
Loaded 1 attestation from GitHub API

The following policy criteria will be enforced:
- OIDC Issuer must match:................... https://token.actions.githubusercontent.com
- Source Repository Owner URI must match:... https://github.com/stacks-network
- Source Repository URI must match:......... https://github.com/stacks-network/sbtc
- Predicate type must match:................ https://slsa.dev/provenance/v1
- Subject Alternative Name must match regex: (?i)^https://github.com/stacks-network/sbtc/

✓ Verification succeeded!

sha256:3f7fd67e2d8ce754ce5890716d94da9fb09327f06ac17acdbc90e5735d0adb09 was attested by:
REPO                 PREDICATE_TYPE                  WORKFLOW
stacks-network/sbtc  https://slsa.dev/provenance/v1  .github/workflows/image-build.yaml@refs/tags/test-attestation