Improve security hygiene and documentation

[ricardoapl]

I noticed prometheus-adapter is lacking in security documentation. I'm thinking about something similar to what was done in kubernetes/kube-state-metrics#2274 for Security Slam - Kubernetes Lightning Round.

Would you like to do this for prometheus-adapter? This means:

• Generating an SBOM automatically when a new release is tagged, so that users have a better understanding of whether or not they're affected by a particular vulnerability
• Generating SLSA/provenance attestation automatically for each new release, so that users can verify the authenticity and trustworthiness of the build process
• Initializing VEX feed and generating OpenVEX data on each release, so that users have a better understanding of which vulnerabilities present a genuine risk
• Setting up CLOMonitor tracking and following-up on any security checks

I believe this relates to https://github.com/kubernetes/sig-release/blob/193a3cdf8d73e0888c7f6829eea3716918a5af4a/roadmap.md

[dashpole]

/assign @ricardoapl
/triage accepted

[ricardoapl]

Maybe we can close this since prometheus-adapter will be archived?

/cc @dgrisonnet

[dgrisonnet]

Yes 👍