[Feature] Sign Docker images

[willianpaixao]

Description

To prevent Supply Chain Attacks, the graph-node Docker image should be signed. It's a simple and one-time setup. I've seen you use GCP ecosystem to build and push to Docker Hub. Simply follow the documentation to setup.

More information can be found at the Sigstore documentation.

A whole walk through sigstore and it's cluster policy controller is described in this blog post.

Are you aware of any blockers that must be resolved before implementing this feature? If so, which? Link to any relevant GitHub issues.

No response

Some information to help us out

• Tick this box if you plan on implementing this feature yourself.
• I have searched the issue tracker to make sure this issue is not a duplicate.