Add a deployment attestation

[marcelamelara]

There may be a use case for authoritatively binding an artifact to a target deployment environment. This could allow consumers to ensure that only the intended containers / artifacts are run in the intended environment context.

Originally proposed in #341.