Merge container-build.yml and release.yml workflows for slsactl

[viccuad]

cosign captures the name of the "sub workflow" that actually did the cosign operation, instead of any of its callers (release.yml -> container-build.yml). Resulting in a signing cert referencing container-image.yml.

This twarts automated verification tools such as slsactl, which would need ad-hoc info to know about these caller workflows.

Acceptance criteria

• Merge container-build.yml workflow into release.yml workflow.
• Make sure that both :latest and tagged container builds and pushes are happening.
• Make sure that only tagged builds push SBOMs (and potentially provenance with buildx) to the registry, as well as creating a GH release.