Release SBOM and SLSA attestation

[tuxerrante]

The released Helm chart and container image should be signed and the relative security artifacts (pem, hashsum...) should be released together with the main artifacts.
Also a SBOM should be present.

Extra references:

• GitHub Action: slsa-github-generator
  • A good example from the ArgoCD project
• Linux Foundation course: lfel1007
• SLSA specs