use cosign attest over cosign attach and upgrade bom

[kranurag7]

We use cosign for signing our images and sbom and for SBOM generation we use bom.

This issue tracks the following:

• upgrade bom to the latest version
• given cosign attach sbom is deprecated we should migrate to using cosign attest

/kind proposal

Copy of SovereignCloudStack/cluster-stack-operator#99 from cso repo

[kranurag7]

completed via #121