ci: fix attest job for multi-arch rock, drop SBOM/scan

[tonyandrewmeyer]

The attest-and-scan job was failing because syft can't parse a multi-arch OCI archive (unexpected media type application/vnd.oci.image.index.v1+json). I realised (belatedly, sorry) I could test this in my fork (passing example) so have reworked it there.

One significant change: it turns out that even though our security team recommend grype, it doesn't understand bare rocks. I was able to work around that for getting the right base, but there are still many false positives because it doesn't understand the Python packages (plus some actual Go issues that should be fixed with some dependency bumps). It seems like the tool is just not usable with a chiselled rock, so I've dropped the scanning part entirely. It isn't strictly needed here since this is a demo image rather than a real product, so we'll just rely on whatever the rock team does. Without the scan, the syft SBOM doesn't provide much value.

I've kept the build provenance attestsrion, though.

Changes:

• Matrix over arch and download the per-arch .rock artifact via glob + merge-multiple: true, resolving the filename dynamically. This fixes the main blocking issue.
• Drop syft SBOM generation, SBOM attestation, and grype scan.
• Rename job attest-and-scan → attest; update upload-ghcr needs accordingly.

I've also dropped the secrets: source-github-token block. The repo is public, so as far as I can tell the reusable build workflow doesn't need REPO_CLONER_TOKEN for cloning. I had to do this to have it work in my fork, but it seems like it's not needed in canonical either. Let me know if I missed something here and I can restore it.