Look into GitHub Artifact attestations

[suzuki-shunsuke]

https://github.blog/changelog/2024-06-25-artifact-attestations-is-generally-available/
https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds

I'm not familiar with this feature, but maybe we can utilize this for the release of aqua and install packages.

[suzuki-shunsuke]

• Create GitHub Artifact Attestations in the release of aqua #3117
• Verify packages using GitHub Artifact Attestations #3118