Support google/ko attachments (sbom, signatures)

**Describe the problem/challenge you have**

google/ko [produces sbom's](https://github.com/google/ko/pull/506) when building an image. However `kbld` [is hardcoded](https://github.com/vmware-tanzu/carvel-kbld/blob/30bcb03300e00443130637ee511c9f5b3a9f99d0/pkg/kbld/builder/ko/ko.go#L34) to publish images to the local docker daemon (via `--local`). Due to the docker daemon unable to store non-container manifests (such as sboms and signatures) these artifacts are dropped when using kbld with ko.

**Describe the solution you'd like**

Preserve attachment images such as sboms and signatures when using the google/ko builder

---
Vote on this request

This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.

👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"

We are also happy to receive and review Pull Requests if you want to help working on this issue.

Start in pkg/kbld/builder/ko/ko.go, especially the hardcoded --local invocation linked in the issue. Trace how the google/ko builder publishes image output and determine where SBOM and signature attachment images are discarded. Done means those attachments are preserved instead of being dropped when kbld uses ko.

Written by the indexing model from the issue text.