Annotate container images with build provenance using Cosign in GitLab CI/CD