ci: attach provenance and SBOM attestations to the published image (#1775)

.github/workflows/docker.yml

@@ -52,6 +52,8 @@ jobs:
         context: .
         platforms: linux/amd64,linux/arm64
         push: ${{ github.event_name != 'pull_request' }}
+        provenance: mode=max
+        sbom: true
         tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}
         cache-from: type=gha