scan-image: emit a cosign-vuln in-toto vulnerability attestation

[toddysm]

Part of #146.

Extend the scan-image composite action to emit a vulnerability attestation
in addition to the JSON report it already produces for gating.

Tasks

• Run trivy image --format cosign-vuln (or trivy convert the existing JSON)
  to produce the Cosign vulnerability scan record.
• Wrap it in an in-toto Statement whose subject is the scanned image digest
  and predicateType is https://cosign.sigstore.dev/attestation/vuln/v1.
• Add a new action output attestation-path pointing at the statement file.

Notes

• Keep the existing report-path / blocking-ids-path outputs unchanged.
• No gate/decision changes.