* ci: Add sbom and attestation
* tools: Add verify-release.sh
* verify-release.sh: Set executable permission
* verify-release.sh: Put downloads into a gitignored directory
* tools: Make verify-release also download sbom
---------
Co-authored-by: OpenSauce04 <opensauce04@gmail.com>