chore: publish attestations to BCR

Note, I've removed the Publish to BCR GH app from this repo.

Author: alexeagle

.github/workflows/release.yml

@@ -8,9 +8,22 @@ on:
     tags:
       - "v*.*.*"
 
+permissions:
+  id-token: write
+  attestations: write
+  contents: write
+
 jobs:
   release:
-    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v6
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.2
     with:
       release_files: toolchains_protoc-*.tar.gz
       prerelease: false
+      tag_name: ${{ github.ref_name }}
+  publish:
+    needs: release
+    uses: ./.github/workflows/publish.yaml
+    with:
+      tag_name: ${{ github.ref_name }}
+    secrets:
+      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}