Only invoke attest-build-provenance once.

Author: alexrp

.github/workflows/release.yml

@@ -41,11 +41,9 @@ jobs:
       - name: Attest packages
         uses: actions/[email protected]
         with:
-          subject-path: out/pkg/dotnet/release/*.nupkg
-      - name: Attest extensions
-        uses: actions/[email protected]
-        with:
-          subject-path: out/pkg/vs*/*.vsix
+          subject-path: |
+            out/pkg/dotnet/release/*.nupkg
+            out/pkg/vs*/*.vsix
       - name: Upload artifacts
         if: always()
         uses: actions/[email protected]