Support GitHub Artifact Attestations

[chenrui333]

GitHub has launched Artifact Attestations built on sigstore to sign artifacts built using GitHub Actions. Generally this should help provide consumers more trust around our artifact process.

• https://github.blog/changelog/2024-06-25-artifact-attestations-is-generally-available/

[DrFaust92]

I might take a look at this after #498