Suboptimal supply chain security for the project

[R3DRUN3]

Feature Request

Is your feature request related to a problem? Please describe:
At its current state, the project exhibits suboptimal supply chain management in the CI pipeline.
The generated OCI images for chaos-mesh are neither signed nor attested.

Describe the feature you'd like:
The proposed solution suggests minimal adherence to industry best practices, by signing and attesting the images (cosign) using their SBOM as a predicate.

Teachability, Documentation, Adoption, Migration Strategy:
Main benefits of the proposed solution are:

1. Certify both image and SBOM provenance.
2. Have the SBOM available in the same registry as the image, enabling effortless downloading for all users.
3. Implementing specific admission policies with tools such as Kyverno and Sigstore Policy Controller.

For an implementation reference on GitHub Actions, please refer to this.