refactor: Create reusable composite action for attestation generation

## Summary

The attestation generation pattern is duplicated across multiple workflows:
- `validate-contribution.yaml` (W1)
- `filter-charts.yaml` (W2)
- `validate-semver-bump.yaml` (W5)
- `release-please.yaml`

Each follows the same pattern:
1. Generate digest from content
2. Call `actions/attest-build-provenance@v2`
3. Call `update_attestation_map()` from attestation-lib.sh

## Proposal

Create a composite action at `.github/actions/generate-attestation/` that encapsulates this:

```yaml
# .github/actions/generate-attestation/action.yml
name: Generate Attestation
description: Generate build attestation and update PR attestation map

inputs:
subject-name:
description: Name for the attestation subject
required: true
subject-content:
description: Content to hash for the subject digest
required: true
pr-number:
description: PR number to update attestation map
required: false
push-to-registry:
description: Whether to push attestation to registry
default: 'false'

outputs:
attestation-id:
description: The generated attestation ID
digest:
description: The subject digest
```

## Benefits

- DRY: Single source of truth for attestation logic
- Consistency: All workflows use the same pattern
- Maintainability: Updates in one place
- Testing: Can test the action in isolation

## Acceptance Criteria

- [ ] Create composite action at `.github/actions/generate-attestation/`
- [ ] Update W1, W2, W5 workflows to use the new action
- [ ] Verify attestation generation still works
- [ ] Update documentation