[feature][byob] Add e2e tests

[laurentsimon]

This will add:

• [ ] pre-submit with a non-signed attestations
• [ ] daily runs

[asraa]

pre-submit with a non-signed attestations

You can use something similar to the docker workflows -- where the sign-attestation step or job is gated by an if statement of whether it's a presubmit.

In that one right now it just checks if event != pull_request but it'd be nice to detect if the OIDC request URL is present for a more accurate check.

When the signing is skipped, we instead just upload the generated DSSE attestations.

[laurentsimon]

let's not forget to add tests for referencing the TRW at a non-tag ref.