Add attestation to releases

.github/CODEOWNERS

@@ -0,0 +1,4 @@
+/lib/                   @braintrustdata/sdk-eng
+/*.gemspec              @braintrustdata/sdk-eng
+/.github/               @braintrustdata/sdk-eng
+/scripts/               @braintrustdata/sdk-eng

.github/workflows/ci.yml

@@ -21,12 +21,12 @@ jobs:
     steps:
     # Security: Pin to commit SHA instead of tag to prevent tag hijacking
     # actions/checkout@v4.3.1
-    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Set up Ruby
       # Security: Pin to commit SHA instead of tag
       # ruby/setup-ruby@v1.295.0
-      uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f
+      uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
       with:
         ruby-version: ${{ matrix.ruby-version }}
         bundler: 'latest'
@@ -44,7 +44,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - run: bash scripts/ensure-pinned-actions.sh
 
   # Summary job that requires all matrix tests to pass