fix(security): bind release evidence to immutable image digests - #1574

Warning: Code scanning cannot determine the alerts introduced by this pull request, because 2 configurations present on refs/heads/main were not found:

Default setup

• ❓  /language:java-kotlin
• ❓  /language:javascript-typescript

View all branch alerts.