chore(ci): fix attest-build-provenance subject-checksums usage

Unlike subject-path, it does not take a glob.

- https://github.com/actions/attest-build-provenance/blob/c6f9859ac6fd46168bba4ac441e2994fa837fc39/action.yml#L26-L30
- https://github.com/actions/attest/blob/9902fb2594e0b5bbab9995737abd2547cde67f22/src/subject.ts#L146-L149

Grab the needed version string from goreleaser metadata output instead.
Ref https://github.com/orgs/goreleaser/discussions/6295

Author: scop

.github/workflows/release.yml

@@ -72,6 +72,7 @@ jobs:
         run: docker login -u golangci -p ${{ secrets.GOLANGCI_LINT_DOCKER_TOKEN }}
 
       - name: Create release
+        id: goreleaser
         uses: goreleaser/goreleaser-action@v6
         with:
           version: latest
@@ -84,7 +85,7 @@ jobs:
 
       - uses: actions/attest-build-provenance@v3
         with:
-          subject-checksums: ./dist/golangci-lint-*-checksums.txt
+          subject-checksums: ./dist/golangci-lint-${{ fromJSON(steps.goreleaser.outputs.metadata).version }}-checksums.txt
           github-token: ${{ secrets.GOLANGCI_LINT_TOKEN }}
       - uses: actions/attest-build-provenance@v3
         with: