sign attestations of unsuccessful rebuilds

[raboof]

when a rebuild is unsuccessful (i.e. produces a result that differs from the already cached one), this result is uploaded via the diff-hook instead of the build-hook. The diff-hook currently does not sign the attestation.