Docs: document the vulnerability-attestation scan-report referrer

[toddysm]

Part of #146. Final step.

Update documentation to describe the payload-bearing vulnerability-attestation
referrer.

Tasks

• docs/architecture/catalog/promote-from-quarantine-workflows.md: update the
  "Scan-report referrer artifact" section (no longer empty).
• docs/reference/image-attestations.md: add a vulnerability-attestation
  section (retrieval via oras discover / oras pull).
• docs/reference/image-annotations.md and
  docs/reference/workflow-actions.md: reflect the new artifact type +
  predicate-type annotation.
• Flip the design doc's Status: proposed note once implemented.