UID2-6764: Add SLSA build provenance attestations to docker publish workflows

[BehnamMozafari]

Summary

• Adds actions/attest@v4.1.0 (pinned to 59d8942...) after the image push in both Java and non-Java shared docker publish paths.
• Grants id-token: write and attestations: write to the publish jobs.
• Skips attestation on snapshot builds via not_snapshot guard.
• Sets NODE_OPTIONS=--max-http-header-size=32768 to mirror what actions/attest-build-provenance did, avoiding HPE_HEADER_OVERFLOW on the OCI registry upload.

Closes UID2-6764. Spike was UID2-5763.

Test plan

• Snapshot smoke test on IABTechLab/uid2-admin (Java path) — run 25421656856 — workflow succeeded, "Attest build provenance" step skipped (proves the not_snapshot guard works), all release-only steps skipped as expected.
• Release-tag E2E: gated on this PR merging + v3 float promotion. Will be exercised on each consumer's first real publish after the rollout PR lands and recorded in the UID2-6764 ticket.
• Non-Java composite-action path: same — covered by uid2-databricks-integration / uid2-snowflake-integration rollout PRs.

Caller-repo follow-up (separate PRs)

After this merges and the v3 float is moved (via update-major-version-tags.yaml), each consumer needs id-token: write + attestations: write added to the calling job. Tracked in UID2-6764:

• uid2-operator
• uid2-core
• uid2-admin
• uid2-optout
• uid2-snowflake-integration
• uid2-databricks-integration

SDK images are explicitly out of scope; follow-up ticket to be filed separately.