Generate SBOM and attestations in the manifests (#126)

# Description

Push all the data into DockerHub

## Issues Resolved

List any existing issues this PR resolves, or any Discourse or
StackOverflow discussions that are relevant

## Type of Change

Our release process assumes you are using [Conventional Commit
messages](https://www.conventionalcommits.org/en/v1.0.0/).

The most important prefixes you should have in mind are:

- `_fix_`: which represents bug fixes, and correlates to a SemVer patch.
- `_feat_`: which represents a new feature, and correlates to a SemVer
minor.
- `_feat!_`:, or `fix!:`, `refactor!:`, etc., which represent a breaking
change (indicated by the !) and will result in a major version change.

If you have not included a conventional commit message this can be fixed
on merge.

## Check List

- [ ] New functionality includes tests
- [ ] All tests pass
- [ ] Commit message includes a [Conventional Commit
Message](https://www.conventionalcommits.org/en/v1.0.0)

Signed-off-by: Tim Smith <[email protected]>

.github/workflows/main.yaml

@@ -92,6 +92,8 @@ jobs:
       - name: Build and push (amd64, arm64)
         uses: docker/build-push-action@v5
         with:
+          sbom: true
+          provenance: true
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           platforms: linux/amd64,linux/arm64