chore(deps): bump actions/attest-build-provenance from 3.0.0 to 4.2.2 - #7

Starting April 2026, the CodeQL Action will skip computing file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. To opt out of this change, set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true`. Alternatively, create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository's settings.

Feature flags do not specify a default CLI version. Falling back to the CLI version shipped with the Action. This is 2.26.2.