ci(security): enable SBOM + provenance attestations for image builds

Author: Thomas Tupper

.github/workflows/publish-image.yml

@@ -45,6 +45,8 @@ jobs:
         with:
           context: .
           push: true
+          provenance: mode=max
+          sbom: true
           tags: |
             ${{ steps.meta.outputs.image }}:latest
             ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.sha_tag }}