inject provider version into apko_config

[imjasonh]

...or otherwise make it available to downstream consumers, like cosign_attest

This lets us include what version of the apko provider was used to build the image, for even more reproducibility signal.