chore(deps): update slsa-framework/slsa-github-generator action to v2

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
slsa-framework/slsa-github-generator	action	major	v1.9.0 -> v2.1.0

---

Release Notes

slsa-framework/slsa-github-generator (slsa-framework/slsa-github-generator)

v2.1.0

Compare Source

v2.1.0: Sigstore Bundles for Generic Generator and Go Builder

The workflows generator_generic_slsa3.yml and builder_go_slsa3.yml
have been updated to produce signed Sigstore Bundles, just like all the other builders
that use the BYOB framework.

The workflow logs will now print a LogIndex, rather than a LogUUID. Both are equally searchanble on
https://search.sigstore.dev/.

v2.1.0: Vars context recorded in provenance

• Updated: GitHub vars context is now recorded in provenance for the generic and
  container generators. The vars context cannot affect the build in the Go
  builder so it is not recorded.

v2.0.0

Compare Source

v2.0.0: Breaking Change: upload-artifact and download-artifact

• Our workflows now use the new @v4s of actions/upload-artifact and
  actions/download-artifact, which are incompatiblle with the prior @v3. See
  Our docs on the generic generator
  for more information and how to upgrade.

v2.0.0: Breaking Change: attestation-name Workflow Input and Output

• attestation-name as a workflow input to
  .github/workflows/generator_generic_slsa3.yml is now removed. Use
  provenance-name instead.

v2.0.0: DSSE Rekor Type

• When uploading signed provenance to the log, the entry created in the log is now
  a DSSE Rekor type. This fixes a bug where the current intoto type does not
  persist provenance signatures. The attestation will no longer be persisted
  in Rekor (#​3299)

v1.10.0

Compare Source

Release v1.10.0 includes bug fixes and new features.

See the full change list.

v1.10.0: TUF fix

• The cosign TUF roots were fixed (#​3350).
  More details here.

v1.10.0: Gradle Builder

• The Gradle Builder was fixed when the project root is the same as the
  repository root (#​2727)

v1.10.0: Go Builder

• The go-version-file input was fixed so that it can find the go.mod file
  (#​2661)

v1.10.0: Container Generator

• A new provenance-repository input was added to allow reading provenance from
  a different container repository than the image itself (#​2956)

v1.9.1

Compare Source

This is an un-finalized release.

See the CHANGELOG for details.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.