use cosign attest over cosign attach and upgrade bom

[kranurag7]

We use cosign for signing our images and sbom and for SBOM generation we use bom.

This issue tracks the following:

• [ ] upgrade bom to the latest version
• [ ] given cosign attach sbom is deprecated we should migrate to using cosign attest

/kind proposal

Copy of https://github.com/SovereignCloudStack/cluster-stack-operator/issues/99 from cso repo

[kranurag7]

completed via https://github.com/SovereignCloudStack/cluster-stack-provider-openstack/pull/121