Add SLSA generator

[norbjd]

Add SLSA generator to generate an attestation (.att manifest pushed in ghcr, matching the image digest):

To verify image provenance:

go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@v2.4.1
go install github.com/google/go-containerregistry/cmd/crane@v0.19.1

IMAGE=ghcr.io/norbjd/k8s-pod-cpu-booster/webhook:202403261225-52a8efb
IMAGE="${IMAGE}@"$(crane digest "${IMAGE}")

slsa-verifier verify-image "$IMAGE" --source-uri github.com/norbjd/k8s-pod-cpu-booster

Result:

Verified build using builder "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v1.10.0" at commit 52a8efb0b53332260ac22c48ae8188fbb1e63219
PASSED: Verified SLSA provenance