Add attestation as a property under security-artifacts

[Danajoyluck]

For software attestation to be added to SECURITY_INSIGHTS.yml, it seems it needs to go under “security-artifacts” > “other-artifacts”. It would be nice to have attestation as an explicit property, similar as SBOM. It will make it a deterministic property for policy engines to pick it up and make decisions during software ingestion.