EPIC: Provide the ability for 3rd party Temurin release reproducible Attestation

[andrew-m-leonard]

The idea of "Attestation" of Trusted Reproducible Verification ties into the secure development and secure supply chain verification, and strengthens the Adoptium SLSA levels.

This epic describes the tasks required to provide a means for Eclipse Temurin release to be "Attested" to a 3rd party completing a secure Trusted Reproducible Verification build.

• Create a documented outline of the 3rd party Reproducible Attestation process #3949
• Architect a "Verified Reproducible Build Attestation" #3950
• Design and build a "Reproducible Build Attestation" and it's Adoptium "process" #3951
• Upgrade temurin-build/cyclonedx-lib build to use cyclonedx-core-java latest "1.6 spec" release #3970
• Experiment with a SigStore Rekor instance #3987