Signed reports

[sketch0395]

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
SIgned reports and attestations suitable for regulated environments, along with pre-backed database images and reproducible build practies

Describe the solution you'd like
A clear and concise description of what you want to happen.
Signed report generation

As a stakeholder
I want to see signed reports
so that I have confidence in ownership of who ran the report

[sketch0395]

manifest works on manual CLI scan, not on github action.