Sign buildpacksio/pack images using cosign and attach sbom generated from binaries

[adwait-godbole]

Fixes #2193

Generate JSON SBOM for release binaries just like how lifecycle is doing right now and use cosign for signing, attaching SBOM and verifying container images.

[adwait-godbole]

Hi @jjbustamante , @natalieparellano, before you go ahead with reviewing this PR, I had a query to clear off my head. Since we are doing a multi-platform image build using buildx, should the cosign sign and cosign attest (for sbom) be done individually for every platform arch image manifest digest or the entire multi-platform index digest as a whole?

[natalieparellano]

@adwait-godbole thank you for this. I'd recommend we do this similarly to how we do it in the lifecycle, you can find the workflow file here: https://github.com/buildpacks/lifecycle/blob/main/.github/workflows/build.yml

The sbom that we attach to the release on GitHub is from linux-amd64. But the sbom that we embed within the lifecycle image is for the particular os/arch that we're shipping (see here). But, since we don't have the concept of sbom-within-the-image for pack, we can probably skip over this.