ci: add SBOM and build provenance attestation for Docker images

[AleF83]

Problem

The Docker images published to GHCR have no Software Bill of Materials (SBOM) and no build provenance attestation. For a public image consumed by other developers and CI pipelines, this is increasingly expected and is a low-effort addition with GitHub's built-in attestation support.

Fix

Add to the build_push_docker job in tag.yaml:

- name: Generate SBOM
  uses: anchore/sbom-action@v0
  with:
    image: ghcr.io/soluto/oidc-server-mock:${{ env.VERSION }}
    artifact-name: sbom.spdx.json

- name: Attest build provenance
  uses: actions/attest-build-provenance@v1
  with:
    subject-name: ghcr.io/soluto/oidc-server-mock
    subject-digest: ${{ steps.build.outputs.digest }}
    push-to-registry: true

Pin all new Actions to SHA digests.

References

Identified during linting/CI audit — see advisory session 2026-05-16.