allow to pass a list of docker images to attest

[caarlos0]

Hey!

So, I was thinking it would make things a lot easier if we could do this:

      - uses: actions/attest-build-provenance@v2
        id: attest
        with:
          subject-images: |
             registry/image:tag@digest
             registry/image2:tag@digest
             another-registry/image2:tag@digest
          push-to-registry: true

The list could then be built on-the-fly if you're using, for example, GoReleaser:

      - run: |
          jq -r '.[] | select(.type | startswith("Published Docker")) | .name + "@" + .extra.Digest' ./dist/artifacts.json >./dist/docker-images
          echo "IMAGES=$(cat ./dist/docker-images)" >> $GITHUB_OUTPUT
      - uses: actions/attest-build-provenance@v2
        id: attest
        with:
          subject-images: |
            ${{ IMAGES }}
          push-to-registry: true

I think this would make an awesome addition, and would make attestation as lot easier as well.

---

For disclosure: I'm the author of GoReleaser.

[caarlos0]

PS: if this is something you're interested in, I'm happy to try and contribute it, and/or test it :)