Push cosign artifacts as attestations

Background

We need to push a project's README and License files to the registry as Cosign artifacts. This is related to IL5 Iron Bank work, and is something that IBFE requires us to complete.

Acceptance Criteria

• License and README are in the registry

Definition of Done

• Can use ORAS or Cosign to download a License and README file