feat: Add attestation entry point to Docker Images

[fabergat]

Description

This PR adds the support to the attestation verification in offline mode and give a suggestion on how to override the Docker entry point for Docker and Docker Compose.

Closes: #1310

Note:

The key material in trusted_root.jsonl does not have a built-in expiration date, so anything signed before you generate the trusted root file will continue to successfully verify. Anything signed after the file is generated will verify until that Sigstore instance rotates its key material, which typically happens a few times per year. You will not know if key material has been revoked since you last generated the trusted root file.

Open questions:

• Is this thing adding a lot more security?
• Is it worth it complicate the config?

Changes

Testing Information

This is a build workflow that generates the attestation files: https://github.com/stacks-network/sbtc/actions/runs/13830677511/job/38694062940

Checklist:

• I have performed a self-review of my code
• My changes generate no new warnings
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[fdefelici]

Added few remarks.

I need also a clarification, to check if my undestanding is right about this need.
We are offering this attestation verification and related samples, to allow a user to create its own docker image with blockstack-cli and signer binary?

[fabergat]

Added few remarks.

I need also a clarification, to check if my undestanding is right about this need. We are offering this attestation verification and related samples, to allow a user to create its own docker image with blockstack-cli and signer binary?

We would like to enforce another small step that automate the process to verify the images source, the idea is to limit the the possibility to run unsigned software. To add to our signer plus the partners

[aldur]

Can you also modify the files under https://github.com/stacks-network/sbtc/blob/main/docker/mainnet/docker-compose.yml and the testnet corresponding version?