Sign and attest GHCR image

[martincostello]

Add steps to attest and sign the images pushed to GHCR with GitHub Attestations and Cosign.

Once merged and verified working, I'll migrate us from build-push-to-dockerhub to the new docker-build-push-image action, then afterwards we should be able to sign the images pushed to Docker Hub too (see #850 and #851).

[Copilot]

Pull Request Overview

This PR adds signing and attestation capabilities for container images pushed to GitHub Container Registry (GHCR). The changes enhance security and provenance tracking by integrating GitHub Attestations for build provenance and Cosign for cryptographic signing of container images.

Key Changes:

• Added build provenance attestation using GitHub's native attestation action
• Integrated Cosign for cryptographic signing of published container images
• Enhanced Docker build configuration with caching and proper output handling

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[martincostello]

Verified with:

VERSION="main"
IMAGE="ghcr.io/grafana/docker-otel-lgtm:${VERSION}"
IDENTITY="https://github.com/grafana/docker-otel-lgtm/.github/workflows/ghcr-image-build-and-publish.yml@refs/heads/${VERSION}"
OIDC_ISSUER="https://token.actions.githubusercontent.com"

cosign verify ${IMAGE} --certificate-identity ${IDENTITY} --certificate-oidc-issuer ${OIDC_ISSUER}

Verification for ghcr.io/grafana/docker-otel-lgtm:main --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The code-signing certificate was verified using trusted certificate authority certificates

[{"critical":{"identity":{"docker-reference":"ghcr.io/grafana/docker-otel-lgtm:main"},"image":{"docker-manifest-digest":"sha256:3c634afce1a25a06e11ff24a150ec500cd220dca80212e97c035511bc9692faa"},"type":"https://sigstore.dev/cosign/sign/v1"},"optional":null},{"critical":{"identity":{"docker-reference":"ghcr.io/grafana/docker-otel-lgtm:main"},"image":{"docker-manifest-digest":"sha256:3c634afce1a25a06e11ff24a150ec500cd220dca80212e97c035511bc9692faa"},"type":"https://slsa.dev/provenance/v1"},"optional":null}]