Consider expanding heuristics for GitHub Actions workflows

[bureado]

There are various patterns a workflow maintainer might engage in to create and persist an SBOM. GitHub Code Search could be potentially used to identify some of those:

path:.github AND (("oras push" AND "sbom") OR "cosign attach sbom" OR /uses.*publish-sbom/) 

With a positive assertion done via GitHub REST API inspection of release assets or workflow artifacts.

Such a search could be expanded with BuildKit's SBOM attestation patterns:

path:.github spdx.dev/Document OR (docker/build-push-action AND "sbom: ")

With a positive assertion done via index traversal per current attestation storage format.

[jspeed-meyers]

@bureado: this is a great idea. Nice thinking!

If you or others want to add SBOMs found via this method, I'm glad to merge such a PR!