Add a script to attest+sign container images

[almet]

We should provide a script to do the whole roundtrip:

• Verify the reproducibility of the image, comparing it with the one published by our CI jobs (see Ensure container image reproducibilty across different container runtimes and versions #1074)
• Verify that attestations match our expectations (see Add attestations to images #1063)
• Sign the container image with a hardware key and publish the signature to the container registry
• Tag the container image as latest