Validate literal `subject-path` entries consistently with other `*-path` inputs

[JamieMagee]

predicate-path and sbom-path fail when their supplied files do not exist. subject-path only fails when the whole input resolves to no files.

For example:

with:
  subject-path: |
    dist/existing.tar.gz
    dist/missing.tar.gz

If existing.tar.gz exists, the action succeeds and silently omits missing.tar.gz from the attestation.

Is this difference intentional? If not, could subject-path fail when any positive literal path is missing? Glob and exclusion patterns could keep their current behavior.

[jeffwidman]

Whenever this lands, we should leverage it to address:

• Fix release archive attestation paths dependabot/cli#657 (review)

[ejahnGithub]

The design is not intentional. predicate-path/sbom-path are single literal paths with a direct existence check, while subject-path supports multiple entries/globs via @actions/glob, which treats zero matches as valid, however, this shouldn’t extend to literal paths mixed in. Will open a fix for this.