sigstore class to sign provenance blobs

Signed-off-by: CrazyMax <[email protected]>

Author: crazy-max

.github/workflows/test.yml

@@ -146,6 +146,9 @@ jobs:
       fail-fast: false
       matrix:
         include: ${{ fromJson(needs.prepare-itg.outputs.includes) }}
+    permissions:
+      contents: read
+      id-token: write # needed for signing with GitHub OIDC Token
     steps:
       -
         name: Checkout