Enable artifact attestations

[takaram]

This PR enables artifact attestations for new releases of actionlint, so that people can verify integrity of binaries downloaded from GitHub Releases.

• https://github.com/actions/attest-build-provenance
• https://goreleaser.com/customization/attestations/

[takaram]

Test release on my fork repo:
https://github.com/takaram/actionlint/releases/tag/v1.7.11

$ gh release download -R takaram/actionlint v1.7.11
$ gh attestation verify -R takaram/actionlint actionlint_1.7.11_linux_amd64.tar.gz

Loaded digest sha256:78fb9ada82ea97285ae17717a9b4739b31d35c22fccc4e1d762913a65957642a for file://actionlint_1.7.11_linux_amd64.tar.gz
Loaded 1 attestation from GitHub API

The following policy criteria will be enforced:
- Predicate type must match:................ https://slsa.dev/provenance/v1
- Source Repository Owner URI must match:... https://github.com/takaram
- Source Repository URI must match:......... https://github.com/takaram/actionlint
- Subject Alternative Name must match regex: (?i)^https://github.com/takaram/actionlint/
- OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!

The following 1 attestation matched the policy criteria

- Attestation #1
  - Build repo:..... takaram/actionlint
  - Build workflow:. .github/workflows/release.yaml@refs/tags/v1.7.11
  - Signer repo:.... takaram/actionlint
  - Signer workflow: .github/workflows/release.yaml@refs/tags/v1.7.11

[rhysd]

Thank you for this patch. This looks a nice improvement.