New release workflow

[arianvp]

Instead of downloading the image from hydra we build the image in GitHub Actions.

This is part of the initiative to get rid of closureInfo like jobs from hydra to reduce pressure in the nixos cache growth. As images store redundant information and take up a lot of wasted space.

All the dependencies of the image should already be cached by hydra so the only thing this build does is assemble the image.

We also attest SLSA build provenance using GitHub Attestations / sigstore using https://github.com/marketplace/actions/attest-build-provenance that records when the image was built and by which GitHub actions workflow.

In the future we want to use https://GitHub.com/arianvp/nix-attest to record nix-specific provenance info but that is blocked on actions/attest#195

We then upload the built image to all AWS regions and sign another attestation linking the image to the image IDs for each region. So that there is a cryptographic statement about which AMIs are official (the AMI namespace is public and open. So anyone can upload any AMI under any name. So we want some statement that these are our AMIs).

[arianvp]

I might want to build the sigstore stuff into the upload-ami Python code directly instead using make this not GitHub specific. But that's future work.
https://github.com/sigstore/sigstore-python