migrate attest-build-provenance to actions/attest v4.1.0

Co-authored-by: v1v <2871786+v1v@users.noreply.github.com>

Author: Copilot

.github/workflows/release-step-3.yml

@@ -106,7 +106,7 @@ jobs:
         run: tar xvf ${{ env.TARBALL_FILE }}
 
       - name: generate build provenance
-        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f  # v3.2.0
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26  # v4.1.0
         with:
           subject-path: "${{ github.workspace }}/**/target/*.jar"
 

.github/workflows/snapshot.yml

@@ -70,7 +70,7 @@ jobs:
         run: tar xvf ${{ env.TARBALL_FILE }}
 
       - name: generate build provenance
-        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f  # v3.2.0
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26  # v4.1.0
         with:
           subject-path: "${{ github.workspace }}/**/target/*.jar"