Fix slsa generation with new action

[puerco]

This pull request updates the release workflow to simplify and modernize the provenance generation and attestation process. The workflow now uses the carabiner-dev/actions/slsa/generate action for SLSA provenance, removes the manual tejolote and bnd steps, and clarifies permissions and documentation.

Provenance and attestation process modernization:

• Replaced manual provenance generation using tejolote and bnd with the automated carabiner-dev/actions/slsa/generate action, which generates and signs SLSA provenance for release artifacts. This simplifies the workflow and improves reliability.
• Added a dedicated "Publish provenance to release" step that uploads the generated provenance attestation to the GitHub release, using the new output from the provenance generation step.
• Removed installation steps for bnd and tejolote, as they are no longer needed with the new provenance generation approach. [1] [2]

Workflow permissions and documentation improvements:

• Updated permissions to clarify the purpose of each permission (e.g., id-token: write for Sigstore signing, actions: read for build attestation) and removed unnecessary permissions.
• Added detailed comments explaining the provenance generation and attestation process for better maintainability and clarity.

[miniprow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: puerco

The full list of commands accepted by this bot can be found here.

Details

Approved by a repository administrator.

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment