ci: Enable artifact attestation for releases

.github/workflows/release.yml

@@ -59,13 +59,22 @@ jobs:
     runs-on: ubuntu-22.04
     permissions:
       contents: write
+      id-token: write
+      attestations: write
     steps:
     - uses: actions/download-artifact@v4
       with:
         pattern: dist-*
         path: dist
         merge-multiple: true
 
+    - uses: actions/attest-build-provenance@v1
+      with:
+        subject-path: |
+          dist/*.whl
+          dist/*.tar.gz
+
+    # only need contents: write
     - uses: ncipollo/release-action@v1
       with:
         artifacts: "dist/*.whl,dist/*.tar.gz"