Bump the prod-deps group with 2 updates

Bumps the prod-deps group with 2 updates: [@actions/attest](https://github.com/actions/toolkit/tree/HEAD/packages/attest) and [@sigstore/oci](https://github.com/sigstore/sigstore-js).


Updates `@actions/attest` from 1.1.0 to 1.2.1
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/attest)

Updates `@sigstore/oci` from 0.2.0 to 0.3.1
- [Release notes](https://github.com/sigstore/sigstore-js/releases)
- [Commits](https://github.com/sigstore/sigstore-js/compare/@sigstore/oci@0.2.0...@sigstore/oci@0.3.1)

---
updated-dependencies:
- dependency-name: "@actions/attest"
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps
- dependency-name: "@sigstore/oci"
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps
...

Signed-off-by: dependabot[bot] <support@github.com>

package.json

@@ -76,11 +76,11 @@
     }
   },
   "dependencies": {
-    "@actions/attest": "^1.1.0",
+    "@actions/attest": "^1.2.1",
     "@actions/core": "^1.10.1",
     "@actions/github": "^6.0.0",
     "@actions/glob": "^0.4.0",
-    "@sigstore/oci": "^0.2.0"
+    "@sigstore/oci": "^0.3.1"
   },
   "devDependencies": {
     "@sigstore/mock": "^0.7.2",