Add SBOM attestations to docker images (#61)

Author: hughns

.github/workflows/docker.yaml

@@ -53,6 +53,8 @@ jobs:
  context: .
  platforms: linux/amd64,linux/arm64
  push: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }} # only push on main branch or release tag
+ provenance: mode=max
+ sbom: true
  tags: ${{ steps.meta.outputs.tags }}
  labels: ${{ steps.meta.outputs.labels }}
  build-args: |