Add signing of blobs to publish command

[marcofranssen]

To securely support fetching of attestations by tag we need to add signatures to the uploaded blobs.

• «repository»:«optional-prefix»-«version».sbom
• «repository»:«optional-prefix»-«version».provenance
• «repository»:«optional-prefix»-«version».discovery

This also requires a change in:

• https://github.com/philips-labs/fatt/tree/publish/pkg/oci for purl to oci.

Also don't forget to bump README.md docs.