ci: opt-in sbom and provenance

[crazy-max]

follow-up moby/buildkit#3345 moby/buildkit#3405

cc @laurentsimon

[crazy-max]

Built artifacts for this PR can be downloaded from https://github.com/docker/buildx/suites/9886852253/artifacts/477397160

$ tree
.
├── buildx-fe25ea8.darwin-amd64
├── buildx-fe25ea8.darwin-amd64.provenance.json
├── buildx-fe25ea8.darwin-amd64.sbom.tar.gz
├── buildx-fe25ea8.darwin-arm64
├── buildx-fe25ea8.darwin-arm64.provenance.json
├── buildx-fe25ea8.darwin-arm64.sbom.tar.gz
├── buildx-fe25ea8.linux-amd64
├── buildx-fe25ea8.linux-amd64.provenance.json
├── buildx-fe25ea8.linux-amd64.sbom.tar.gz
├── buildx-fe25ea8.linux-arm-v6
├── buildx-fe25ea8.linux-arm-v6.provenance.json
├── buildx-fe25ea8.linux-arm-v6.sbom.tar.gz
├── buildx-fe25ea8.linux-arm-v7
├── buildx-fe25ea8.linux-arm-v7.provenance.json
├── buildx-fe25ea8.linux-arm-v7.sbom.tar.gz
├── buildx-fe25ea8.linux-arm64
├── buildx-fe25ea8.linux-arm64.provenance.json
├── buildx-fe25ea8.linux-arm64.sbom.tar.gz
├── buildx-fe25ea8.linux-ppc64le
├── buildx-fe25ea8.linux-ppc64le.provenance.json
├── buildx-fe25ea8.linux-ppc64le.sbom.tar.gz
├── buildx-fe25ea8.linux-riscv64
├── buildx-fe25ea8.linux-riscv64.provenance.json
├── buildx-fe25ea8.linux-riscv64.sbom.tar.gz
├── buildx-fe25ea8.linux-s390x
├── buildx-fe25ea8.linux-s390x.provenance.json
├── buildx-fe25ea8.linux-s390x.sbom.tar.gz
├── buildx-fe25ea8.windows-amd64.exe
├── buildx-fe25ea8.windows-amd64.provenance.json
├── buildx-fe25ea8.windows-amd64.sbom.tar.gz
├── buildx-fe25ea8.windows-arm64.exe
├── buildx-fe25ea8.windows-arm64.provenance.json
└── buildx-fe25ea8.windows-arm64.sbom.tar.gz

0 directories, 33 files

[laurentsimon]

Thanks for tagging. Do you have documentation how it's generated / signed, and how the provenance generation is isolated from the build itself?