This is mostly just for specificity. In practice this will never do anything in CI because there will never be any cache to use, but if there was, we wouldn't want to use it
* ci: Add sbom and attestation
* tools: Add verify-release.sh
* verify-release.sh: Set executable permission
* verify-release.sh: Put downloads into a gitignored directory
* tools: Make verify-release also download sbom
---------
Co-authored-by: OpenSauce04 <opensauce04@gmail.com>