refactor(security): promote attest-image.sh to shared scripts/security/ when a second image producer lands

[nguyena2]

Context

fleet-deployment/setup/attest-image.sh currently lives next to its only caller, build-aml-model-image.sh, and sources fleet-deployment/setup/defaults.conf plus the inference-specific VEX at security/vex/inference-base.openvex.json.

The underlying logic (cosign spdxjson + openvex attest, notation sign, oras attach, syft SBOM generation) is image-agnostic. The fleet-specific parts are config (which VEX, which AKV key, which mode) and the build → attest handoff message.

Trigger

Open this work when a second image producer needs SBOM/VEX attestation. Likely candidates already in the repo:

• data-management/viewer/backend/Dockerfile
• data-management/viewer/frontend/Dockerfile
• evaluation/sil/docker/Dockerfile.lerobot-eval

Proposed change

1. Promote attest-image.sh to scripts/security/attest-image.sh as a pure CLI tool: required inputs --image, --mode, --vex-file, --sbom-file, --akv-key-id. No defaults.conf sourcing inside the script.
2. Keep per-image config in each component's local defaults.conf (fleet-deployment/setup/, data-management/viewer/..., evaluation/sil/...). Each component's build script resolves values and invokes the shared tool.
3. Move VEX documents to per-image paths under security/vex/<component>-<image>.openvex.json and update the README docs accordingly.
4. Update fleet-deployment/setup/README.md and any new component READMEs to reference the shared tool.

Out of scope

• Doing this before a second producer exists (would add indirection with no duplication payoff).
• Touching scripts/security/generate-vex.sh — VEX authoring stays separate from per-image attestation.

Acceptance criteria

• scripts/security/attest-image.sh exists and is pure (no component defaults.conf sourcing).
• fleet-deployment/setup/build-aml-model-image.sh invokes the shared tool with locally-resolved values.
• At least one additional image producer invokes the same shared tool.
• Each attested image has its own VEX under security/vex/<component>-<image>.openvex.json.
• Docs updated.

Originally discussed on branch feat/aml-model-push-to-acr.