[llvm] workflows: Factor out artifact attestation and upload into a composite action (PR #169621)

[Tom Stellard via llvm-commits]

tstellar wrote:

@boomanaiden154 I've re-worked this a little bit,and I'm happy with it now.  I removed the artifact upload step from the new composite action, so that the attestation can be done in a job that is separate from where we build the sources tarballs or eventually binaries once I integrated it into other workflows.  This let's us keep the permissions low for those jobs and only use the higher permissions for a separate job that does the attestations.

https://github.com/llvm/llvm-project/pull/169621