ci: Add GitHub artifact attestations to package distribution

[matthewfeickert]

trafficstars

• Add generation of GitHub artifact attestations to built sdist and wheel before upload. c.f.:
  • https://github.blog/2024-05-02-introducing-artifact-attestations-now-in-public-beta/
  • https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds