attach-scan-report: attach the vuln attestation payload, keep annotations

[toddysm]

Part of #146. Depends on the scan-image and scan-sbom children.

Change the attach-scan-report composite action from attaching an empty
artifact to attaching the in-toto vulnerability attestation as the payload
layer, while keeping all existing com.cssc.scan.* annotations.

Tasks

• Add a required input for the attestation (statement) file path.
• Change --artifact-type to application/vnd.in-toto+json.
• Add annotation in-toto.io/predicate-type=https://cosign.sigstore.dev/attestation/vuln/v1.
• Attach the statement file as the payload layer with
  --disable-path-validation.
• Keep every existing annotation, including the com.cssc.scan.override* set.

Notes

• Backward compatible for annotation readers; only the artifact type and payload
  change.