Disable Docker build provenance in an attempt to fix GHCR adding ghost images

[emmadesilva]

GitHub is adding corrupted near-empty ghcr.io/hydephp/cli:sha256-*.sig "ghost" images, hopefully disabling provenance could fix this. See docker/build-push-action#771

Example output of trying to pull one of these

docker pull ghcr.io/hydephp/cli:sha256-23a782711e7cfdbaf0a5d13bd95d814ec614178cdbb9052750ace5d766ff59aa.sig
sha256-23a782711e7cfdbaf0a5d13bd95d814ec614178cdbb9052750ace5d766ff59aa.sig: Pulling from hydephp/cli
4c7c2b079c7b: Extracting [==================================================>]     235B/235B
failed to register layer: Error processing tar file(exit status 1): unexpected EOF

This tries to fix #227