Add SLSA 3 Provenance

[dennisshey]

This PR updates the GitHub Actions workflow to include SLSA 3 compliance for the Pi4Micronaut library JAR artifacts.

• The workflow now generates verifiable provenance for the JAR files built via Gradle (shadowJar).
• Provenance ensures that any published library comes directly from this repository, built via GitHub Actions, and cannot be tampered with.

Changes

• Added permissions for OIDC-based provenance signing (id-token: write, contents: write).
• Added a step to generate SLSA provenance for all JAR files in pi4micronaut-utils/build/libs/*.jar.
• Uploaded the JAR artifact in the workflow so it can be referenced for verification.

Why

• Supply chain security is critical for open-source libraries. By adopting SLSA 3:
• Downstream users and projects can independently verify the authenticity of library releases.
• The build process becomes tamper-evident and traceable to the exact source commit.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ leandrumartin
❌ dennisshey
_{You have signed the CLA already but the status is still pending? Let us recheck it.}