ci: Add GitHub artifact attestations to package distribution

[matthewfeickert]

• Add generation of GitHub artifact attestations to built sdist and wheel before upload.
  c.f.:
  • https://github.blog/2024-05-02-introducing-artifact-attestations-now-in-public-beta/
  • https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds
• Update python-jsonschema/check-jsonschema pre-commit hook to recognize attestations permissions key.

[matthewfeickert]

@henryiii I saw that you reran the failing Pyodide wheel tests, but they're still failing, though have to be unrelated to this PR.

[HDembinski]

You requested review from me, but Henry normally handles boost-histogram. I can work on this if Henry is busy.

[matthewfeickert]

Thanks @HDembinski. If @henryiii normally covers this then I'll let him get to it whenever he has time — no rush here. Thanks though!

[henryiii]

Yes, I've just been hoping the pyodide test would resolve, but it looks like something has changed and I'll need to debug. Doing so in #934.

For my understanding, this only shows up in GitHub's page for now (and in the future PyPI might accept them too)?

[henryiii]

Thanks!

[matthewfeickert]

Once this runs during a release the attestations will be uploaded to https://github.com/scikit-hep/boost-histogram/attestations and can be verified from a wheel or sdist artifact using the gh attestation verify CLI API. c.f. scikit-hep/pyhf#2473 for examples of that.