chore: create attest job for the dev container prebuilt image

[tschaffter]

Description

The workflow previously failed to generate and publish the build attestation because the permission id-token: write was missing.

UPDATE:

To verify the attestation of the Docker image using the GitHub CLI, you can use the following command:

$ gh attestation verify --owner Sage-Bionetworks oci://ghcr.io/sage-bionetworks/sage-monorepo-devcontainer:sha-5cd10f9d963
e69f330b283166824ccd2b77bac8d
Loaded digest sha256:84408f15bb8e1b617285329a140b0ddebaf44f563b2d18acddf845484ccd42ce for oci://ghcr.io/sage-bionetworks/sage-monorepo-devcontainer:sha-5cd10f9d963e69f330b283166824ccd2b77bac8d
Loaded 1 attestation from GitHub API
✓ Verification succeeded!

sha256:84408f15bb8e1b617285329a140b0ddebaf44f563b2d18acddf845484ccd42ce was attested by:
REPO                            PREDICATE_TYPE                  WORKFLOW                                                               
Sage-Bionetworks/sage-monorepo  https://slsa.dev/provenance/v1  .github/workflows/build-and-push-devcontainer-image.yml@refs/heads/main

Note: The image does not need to be pulled first.