Disable Sigstore attestations in publish workflow

[ddrthall]

What

Disables the experimental Sigstore attestation feature in the rubygems/release-gem action by setting attestations: false.

Why

The attestation patch (rubygems-attestation-patch.rb) is injected via RUBYOPT and activates the system openssl 3.2.2 (default gem in Ruby 3.3) before Bundler can load openssl 4.0.2 from the lockfile. This causes:

You have already activated openssl 3.2.2, but your Gemfile requires openssl 4.0.2.
Since openssl is a default gem, you can either remove your dependency on it or try
updating to a newer version of bundler that supports openssl as a default gem.
(Gem::LoadError)

Impact

• The release process is otherwise identical: gem build, git tag, gem push via OIDC Trusted Publishing
• Attestations are marked [EXPERIMENTAL] in the release-gem action
• The previous manual release process (rake release with local credentials) never had attestations
• No gem consumers verify Sigstore attestations for this package