Support single-subject attestations

[bdehamer]

Context

actions/attest currently combines every resolved subject into one attestation. Some consumers—notably PyPI and PEP 740 tooling—require each attestation statement to contain exactly one subject.

This adds an opt-in mode for that use case while retaining the existing multi-subject behavior by default. Addresses #213.

Changes

• add the single-subject-attestations input, limited to 100 resolved subjects
• create attestations serially with a one-second delay between operations
• continue after individual failures, preserve successful bundles, and fail after all subjects have been attempted
• add a results-path output with per-subject IDs, URLs, bundle lines, and errors
• emit the existing singular outputs only when one logical attestation is attempted successfully
• allow multiple OCI subjects with push-to-registry in single-subject mode using the existing registry path

Validation

• npm run format:check
• npm run lint
• npm run ci-test
• npm run package
• git diff --check