Add SLSA to goreleaser workflow

[manno]

When doing prime releases, goreleaser needs to push to that registry.

Similar to https://github.com/rancher/ecm-distro-tools/blob/45fe661ce4c4d58e938e480383ce5ef26c251cb6/actions/publish-image/action.yaml#L163-L175

goreleaser should sign the image, when doing the buildx of the image.

[thardeck]

Todo

• Fix creating docker manifests for Prime (see issue mentioned above)
• Add exception for fleet-agent to slsactl
• Add attestation of provenance to the workflow
• Use Docker image digest for cosign

[thardeck]

PR for slsactl.

[thardeck]

The docker manifest creation issue is not related the Prime registry permissions, but the fact that we only use provenance meta data there.

docker manifest create then complains that the referenced docker image is a manifest list.

The issue is explained here.

Unfortunately the "real solution" does not work (as confirmed in the comments) because we are already using containerd as storage.

So until this is fixed I suppose we have to rely on yet another step. And signing for the manifest in GoReleaser is then also not possible.

[thardeck]

All new releases should be signed in the Prime registry.

Successful run for Fleet v0.12.0-alpha.9: https://github.com/rancher/fleet/actions/runs/13118758740/job/36601584636