chore(actions): Add doc how to verify GH attestations with GitHub cli and verify release artifacts with Cosign

[ViacheslavKudinov]

Resolves #NaN

---

Before the change?

• There is no doc how to verify attestations

After the change?

• Add how to use verification of attestations with GitHub CLI
  https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/use-artifact-attestations
• Add Cosign verification

Pull request checklist

• Schema migrations have been created if needed (example)
• Tests for the changes have been added (for bug fixes / features)
• Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

• Yes
• No

---

[ViacheslavKudinov]

Any known thing why we may regret by adding attestation?

Just loudly thinking if anything we need to consider

[ViacheslavKudinov]

@nickfloyd @stevehipwell I've updated PR to resolve conflicts after workflows were updated.
Now it includes only doc how to do verification of attestations.

Please, feel free to suggest any updates.

[stevehipwell]

Would it be possible to add the cosign equivalents of the gh commands? We also ought to provide the command to verify the SHA256SUMS file signature.

[ViacheslavKudinov]

@stevehipwell i've updated doc.
It is not exactly equivalents as with Cosign is only signed checksum file,
but anyway i tried to cover what we can do with current settings to verify the SHA256SUMS file signature and then with checksum the artifact(s).

Please, let me know if something else was expected or i've missed.

[stevehipwell]

I've added some comments, note that you can also verify the attestations with cosign.