Fix attestation doc filename, limit digest generation to files below dist/

Author: eliheady

.github/workflows/release_draft.yml

@@ -69,7 +69,7 @@ jobs:
       id: collect
       run: |
         echo "generating digests for artifacts"
-        echo "hashes=$(find . -type f \( -name \*dnscontrol\* -o -name \*checksums.txt \) -exec sha256sum {} \; | base64 -w0)" >> "$GITHUB_OUTPUT"
+        echo "hashes=$(find dist -type f \( -name \*dnscontrol\* -o -name \*checksums.txt \) -exec sha256sum {} \; | base64 -w0)" >> "$GITHUB_OUTPUT"
 
   slsa:
     needs: [draft_release]

SECURITY.md

@@ -26,7 +26,7 @@ The [SLSA verifier](https://github.com/slsa-framework/slsa-verifier) tool can be
 
 ```shell
 slsa-verifier verify-artifact dnscontrol_4.19.0_darwin_all.tar.gz \
-  --provenance-path multiple.intoto.json \
+  --provenance-path multiple.intoto.jsonl \
   --source-uri github.com/StackExchange/dnscontrol \
   --source-tag v4.20.0
 ```