Disable docker provenance attestation and bump transformers to 5.9.0 (#256)

Rebased onto main (GAR migration already merged). Net changes:
- docker.yml: disable provenance attestation on docker builds
- uv.lock: bump transformers to 5.9.0

Author: mgsalem

.github/workflows/docker.yml

@@ -122,3 +122,4 @@ jobs:
             ${{ github.event_name != 'pull_request' && format('{0}:{1}', steps.image.outputs.base, steps.backend-version.outputs.version) || '' }}
             ${{ github.event_name != 'pull_request' && format('{0}:latest', steps.image.outputs.base) || '' }}
           labels: ${{ steps.meta.outputs.labels }}
+          provenance: false