Add SLSA signing and provenance to release

[alexander-demicev]

What this PR does / why we need it:

This PR adds SLSA signing and provenance to release:

• We publish an image for each arch we support and one multiarch, PR includes a script with a new make task that outputs all images and digests, these are later used to build a matrix for signing and verifying images: [{image: "image1:tag" digest: "imagedigest1"}, {image: "image2:tag" digest: "imagedigest2"}]
• Sign artifacts with cosign and create provenance using a reusable workflow provided by slsa-framework

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

Checklist:

• squashed commits into logical changes
• includes documentation
• adds unit tests
• adds or updates e2e tests

[richardcase]

Great work @alexander-demicev, looks good to me.