feat(sign): attest only the platforms a release adds

netork's release joins an arm64 image to the amd64 one its dev build
already signed and attested, under a new index. ATTEST_PLATFORMS (the sign
action's attest-platforms) signs the new index and every platform behind
it, and attests only the ones named.

actions/sign/action.yml

@@ -13,6 +13,11 @@ inputs:
   expect-platforms:
     description: The platforms the reference must hold, e.g. "amd64 arm64"; empty takes what is there
     default: ""
+  attest-platforms:
+    description: >-
+      The platforms to attest, e.g. "arm64"; empty attests every one. A release
+      index joins a new platform to one already attested.
+    default: ""
 runs:
   using: composite
   steps:
@@ -25,4 +30,5 @@ runs:
         REF: ${{ inputs.ref }}
         DIR: ${{ inputs.dir }}
         EXPECT_PLATFORMS: ${{ inputs.expect-platforms }}
+        ATTEST_PLATFORMS: ${{ inputs.attest-platforms }}
       run: bash "${{ github.action_path }}/../../bin/sign.sh" "$REF" "$DIR"