Improve build security

[reneleonhardt]

trafficstars

It's best practice to harden builds, for example with standard tools like Harden-Runner and cosign: https://github.com/step-security/harden-runner https://github.com/sigstore/cosign