sigstore class to sign buildkit provenance blobs

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

package.json

@@ -46,6 +46,7 @@
   },
   "dependencies": {
     "@actions/artifact": "^4.0.0",
+    "@actions/attest": "^2.0.0",
     "@actions/cache": "^4.1.0",
     "@actions/core": "^1.11.1",
     "@actions/exec": "^1.1.1",
@@ -56,6 +57,8 @@
     "@azure/storage-blob": "^12.15.0",
     "@octokit/core": "^5.2.2",
     "@octokit/plugin-rest-endpoint-methods": "^10.4.1",
+    "@sigstore/bundle": "^3.1.0",
+    "@sigstore/sign": "^3.1.0",
     "async-retry": "^1.3.3",
     "csv-parse": "^6.1.0",
     "gunzip-maybe": "^1.4.2",
@@ -68,6 +71,8 @@
     "tmp": "^0.2.5"
   },
   "devDependencies": {
+    "@sigstore/mock": "^0.10.0",
+    "@sigstore/rekor-types": "^3.0.0",
     "@types/gunzip-maybe": "^1.4.2",
     "@types/he": "^1.2.3",
     "@types/js-yaml": "^4.0.9",