publishing rke2 images to rancher prime registry

[brooksn]

RKE2 images will be published to the rancher prime registry and signed with cosign. Additionally, images are to include an SBOM manifest provided by docker buildx.

Build pipelines in the image-build-* repositories should be updated to use the publish-image action, and the prime registry credentials should be added to the vault data for each repository.

Repository	Workflow	Registry credentials	Signed image
addon-resizer	✅	✅	hardened-addon-resizer:1.8.20-build20241001
calico	✅	✅	v3.28.2-build20241016
cni-plugins	✅	✅	hardened-cni-plugins:v1.5.1-build20241008
coredns	✅	✅	hardened-coredns:v1.11.1-build20241008
dns-nodecache	✅	✅	hardened-dns-node-cache:1.23.1-build20241008
etcd	PR
flannel	✅	✅	hardened-flannel:v0.25.7-build20241008
metrics server	✅	✅	hardened-k8s-metrics-server:v0.7.1-build20241008
kubernetes	✅	✅	v1.31.1-rke2r2-build20241014
multus	✅		hardened-multus-cni:v4.1.2-build20241011 hardened-multus-thick:v4.1.2-build20241011
node-feature-discovery	✅	✅	hardened-node-feature-discovery:v0.16.4-build20241011
whereabouts	✅	✅	hardened-whereabouts:v0.8.0-build20241011
ingress-nginx	PR 1.10.x - PR 1.11.x @rafaelbreno
cluster-proportional-autoscaler	✅	✅	hardened-cluster-proportional-autoscaler:v1.8.11-build20241014
rke2-cloud-provider	✅	✅	rke2-cloud-provider:v1.31.1-build20241011
rke2

[brandond]

sriov images have been removed from rke2, as the sriov charts are not tied to specific rke2 releases.

[brooksn]

EIO issue to install prime registry credentials
https://github.com/rancherlabs/eio/issues/2631

[manuelbuil]

I think https://github.com/rancher/image-build-cluster-proportional-autoscaler is missing and https://github.com/rancher/image-build-node-feature-discovery is part of the sriov solution

[briandowns]

Side task:

Evaluate which images are produced through the RKE2 SLSA L3 process and images synced to the Prime Registry and prevent overwrites.