publish attestations for release container images

[qrkourier]

Verify the public attestation for an image:

gh attestation verify --owner openziti oci://docker.io/openziti/zrok:0.4.49

ref: https://cli.github.com/manual/gh_attestation_verify

---

Inspect the bundled SBOM:

docker buildx imagetools inspect openziti/zrok:0.4.49 \
    --format "{{ json .SBOM.SPDX }}"

ref: https://docs.docker.com/build/metadata/attestations/sbom/#inspecting-sboms

---

Inspect the bundled SLSA:

docker buildx imagetools inspect openziti/zrok:0.4.49 \
    --format "{{ json .Provenance.SLSA }}"

ref: https://docs.docker.com/build/metadata/attestations/slsa-provenance/#inspecting-provenance

---

bonus: extract the Dockerfile from the SLSA metadata:

 docker buildx imagetools inspect openziti/zrok:0.4.49 \
    --format '{{ range (index .Provenance.SLSA.metadata "https://mobyproject.org/buildkit@v1#metadata").source.infos }}{{ if eq .filename "Dockerfile" }}{{ .data }}{{ end }}{{ end }}' | base64 -d