Publish releases to BCR with attestations

[hvadehra]

Context: bazelbuild/bazel-skylib#581 (comment)

[hvadehra]

The legacy app will be discontinued in June 2026 (https://github.com/bazel-contrib/publish-to-bcr?tab=readme-ov-file#legacy-github-app), so this needs to be done ~soon.