Integrate SLSA Level 3 provenance, isolated container builds, and code coverage reporting

[asmit27rai]

Description

This PR addresses the supply-chain security and CII Best Practices criteria on the LFX security checklist:

1. SLSA Level 3 Provenance Generation:

   • Integrated slsa-framework/slsa-github-generator reusable workflow into .github/workflows/ci-latest-release.yml.
   • Generates non-falsifiable .intoto.jsonl attestation provenance files and uploads them as release assets alongside container & binary releases.

2. Network-Isolated Container Compilation:

   • Updated Dockerfile and pkg/KubeArmorController/Dockerfile to copy go.mod/go.sum and run go mod download && go mod verify prior to copying full source code.
   • Enforced GOPROXY=off during make and go build steps to guarantee zero outbound network calls during compilation.

3. Continuous SLSA Provenance Verification:

   • Created .github/workflows/slsa-verify.yml to automatically verify release artifacts against .intoto.jsonl attestations using slsa-verifier verify-artifact.

4. Code Coverage Reporting:

   • Updated .github/workflows/ci-test-go.yml to execute go test -coverprofile=coverage.txt -covermode=atomic ./... and report results via codecov/codecov-action.

5. Badges:

   • Added SLSA Level 3 badge and Codecov coverage badge to README.md.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 4.18%. Comparing base (9ecd20a) to head (3241f9a).
⚠️ Report is 628 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##           main   #2839      +/-   ##
=======================================
+ Coverage      0   4.18%   +4.18%     
=======================================
  Files         0      63      +63     
  Lines         0   15420   +15420     
=======================================
+ Hits          0     646     +646     
- Misses        0   14709   +14709     
- Partials      0      65      +65     

Flag	Coverage Δ
unittests	4.18% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Aryan-sharma11]

let's use ubuntu-latest

[asmit27rai]

done

[Aryan-sharma11]

why are we copying pkg directory?

[asmit27rai]

In kubearmor/go.mod, there is local replacement replace github.com/kubearmor/KubeArmor/pkg/KubeArmorController => ../pkg/KubeArmorController
In dependency caching step go mod download and go mod verify validate all module replacements.
COPY pkg/ ./pkg/ is needed so Go can resolve the local relative path without throwing a missing error