feat: add image provenance attestation to local workflow and caller permissions (#833)

* feat: add image provenance attestation to local workflow and caller permissions

node-agent uses a local copy of incluster-comp-pr-merged.yaml instead
of the shared kubescape/workflows version. This commit:
- Adds attestations: write to pr-merged.yaml caller permissions
- Adds id: build to capture image digest from build-push step
- Adds actions/attest-build-provenance step to the local workflow copy

Signed-off-by: Varadraj75 <agrawalvaradraj2007@gmail.com>

* fix: update to actions/attest@v4.1.0 replacing deprecated attest-build-provenance

actions/attest-build-provenance v4+ is a wrapper on actions/attest.
New implementations should use actions/attest directly per upstream guidance.

Signed-off-by: Varadraj75 <agrawalvaradraj2007@gmail.com>

---------

Signed-off-by: Varadraj75 <agrawalvaradraj2007@gmail.com>