Add attestations to images

[almet]

We want to ensure that the images we build are built by the Github CI, and from a job related to the freedomofpress/dangerzone repository.

Attestations should be available on the Github Container registry.

Interesting to note:

The Cosign Bundle Specification explains how image attestations are to be represented as OCI artifacts, and attached to the container registry. This is what's being used via cosign attest

Currently the Attestation Specification is used, which uses Layers to represent attestations and annotations to specify the verification material.

The cosign bundle spec is sigstore/cosign#3889 in cosign but this isn't done yet.

[almet]

Actually already tracked by #1035