Merge the "enhancement/buildkit-attestations-max" branch into the "develop" branch

This merge updates `.github/workflows/deployment.yml` to grant the release workflow the permissions needed for signed BuildKit attestations and to switch the image build step from boolean provenance and SBOM flags to explicit `attests:` entries. The release build now requests `mode=max` provenance and SBOM attestations so published images carry the full attestation payload supported by BuildKit.

In the top-level `permissions:` block, the workflow now adds `id-token: write` so the job can mint the OIDC token required for attestation signing. In the `Build and push (multi-registry, multi-platform)` step, `provenance: true` is replaced with `attests:` entry `type=provenance,mode=max`, and `sbom: true` is replaced with `attests:` entry `type=sbom,mode=max`, leaving the rest of the build configuration unchanged.

No other files or workflow jobs are modified by this merge.

Author: Amnoor

.github/workflows/deployment.yml

@@ -36,6 +36,7 @@ permissions:
   contents: read
   packages: write
   deployments: write
+  id-token: write
 
 # Global environment variables used across jobs.
 env:
@@ -121,8 +122,9 @@ jobs:
           platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          provenance: true
-          sbom: true
+          attests: |
+            type=provenance,mode=max
+            type=sbom,mode=max
           cache-from: type=gha
 
       # Marking deployment as "success" if the workflow succeeds.