* feat: set container policy to validate Blue-Build cli signature

* Update action.yml

* Update action.yml

* Update action.yml

* Update action.yml

* Apply suggestion from @gmpinder

Co-authored-by: Gerald Pinder <[email protected]>

---------

Co-authored-by: Gerald Pinder <[email protected]>

* feat: add provenance verification

* cleanup

* Update action.yml

Co-authored-by: Gerald Pinder <[email protected]>

* comment

* policy enforcement

* remove sed

---------

Co-authored-by: Gerald Pinder <[email protected]>

* Configure podman to use sigstore attachments for signature
  verification of images from `ghcr.io/blue-build`.
* Simplify container policy.json edits by adding both policies in a
  single `jq` command and using `+=` instead of `|= . +`.
* Make uses of curl more robust by adding retries and rejecting
  responses with HTTP status codes indicating failure. Also use `-S`
  option to show error output, making it more apparent when a build
  failure is due to transient network issues. Also use `sudo tee`
  instead of running curl as root.

This ensures exit codes indicating failure aren't suppressed by pipes
(which could be a problem, for example, with patterns like `curl ... |
sudo tee ...`).

Need to use `cat | sudo tee ...` rather than `sudo cat > ...` to write
to a file as root.

The wrong input was being passed to `INPUT_RECHUNK`.

The `jlumbroso/free-disk-space` action is unmaintained (no commits in
over 2 years). I made a GitHub action at `hastd/free-disk-space` that
serves the same purpose while being up-to-date and significantly faster.

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.11.0 to 3.11.1.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@18ce135...e468171)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 3.11.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Gerald Pinder <[email protected]>

Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.9.1 to 4.0.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@398d4b0...faadad0)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 6.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4.2.2...1af3b93)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

#102)

Bumps [googleapis/release-please-action](https://github.com/googleapis/release-please-action) from 4.2.0 to 4.4.0.
- [Release notes](https://github.com/googleapis/release-please-action/releases)
- [Changelog](https://github.com/googleapis/release-please-action/blob/main/CHANGELOG.md)
- [Commits](googleapis/release-please-action@a02a34c...16a9c90)

---
updated-dependencies:
- dependency-name: googleapis/release-please-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>