Grant CI permissions for image attestation/signing #177

Part of posit-dev/images-shared#453. Depends on the signing-method spike in that repo.

Grant whatever job permissions the chosen signing method requires (e.g. id-token: write + attestations: write for GitHub Artifact Attestations) to workflows that call the shared build workflow with push: true:

• production.yml
• development-positron.yml
• development-workbench.yml
• session.yml

Also document how to verify image attestations in this repo's README once the method is finalized.