dispatch-build-bottle: add provenance step

[woodruffw]

• Have you followed the guidelines for contributing?
• Have you ensured that your commits follow the commit style guide?
• Have you checked that there aren't other open pull requests for the same formula update/change?
• Have you built your formula locally with HOMEBREW_NO_INSTALL_FROM_API=1 brew install --build-from-source <formula>, where <formula> is the name of the formula you're submitting?
• Is your test running fine brew test <formula>, where <formula> is the name of the formula you're submitting?
• Does your build pass brew audit --strict <formula> (after doing HOMEBREW_NO_INSTALL_FROM_API=1 brew install --build-from-source <formula>)? If this is a new formula, does it pass brew audit --new <formula>?

---

This is a demonstration of one approach; another approach is to design a reusable workflow to be shared across different uploading workflows, although that's going to be more involved due to a need to re-upload/uniformly stage the bottle artifacts.

I'm not sure if there's a straightforward way to test this locally, unfortunately.

Behavioral changes:

• Changed the ~/bottles download location to $GITHUB_WORKSPACE/bottles and abstracted it into the environment
• Added a build provenance generation step, matching the one in publish-commit-bottles.yml

[Bo98]

I agree this is simplest

[MikeMcQuaid]

Makes sense to me!

[woodruffw]

Thanks all! I'll keep an eye on this for problems, and follow up with the other workflows once this one is confirmed good.