chore: next step in container image publishing

[tarilabs]

recommend:

• use docker/build-push-action for multi-arch in the ci/cd GHA (gives us rich metadata)
• using the anchore/sbom-action to produce the spdx sbom
• Attest, not Attach, the sbom with cosign along with image signature (this would ensure also the sbom is signed)

following up on #1790 (review)

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[tarilabs]

Not stale

[tarilabs]

We did it with #2032