Add support for fetching artifact attestations at the org, repo and user level

[gillisandrew]

GitHub artifact attestations is now generally available

This pull request adds support for listing attestations hosted on GitHub for a given subject digest. Those attestations can then be verified using another library such as sigstore-go. I've included a basic demo as an example.

[gmlewis]

Thank you, @gillisandrew!
A few questions and tweaks, please.

[codecov]

Codecov Report

Attention: Patch coverage is 29.82456% with 120 lines in your changes missing coverage. Please review.

Project coverage is 92.29%. Comparing base (2b8c7fa) to head (c1900ae).
Report is 159 commits behind head on master.

Files with missing lines	Patch %	Lines
example/verifyartifact/main.go	0.00%	120 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## master #3334 +/- ##
==========================================
- Coverage 97.72% 92.29% -5.43% 
==========================================
Files 153 176 +23 Lines 13390 15019 +1629 ==========================================
+ Hits 13085 13862 +777 - Misses 215 1064 +849 - Partials 90 93 +3 

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[gmlewis]

Thank you, @gillisandrew .
Please add unit tests for the newly-added methods.

[gmlewis]

Thank you, @gillisandrew !
LGTM.

Awaiting second LGTM+Approval from any other contributor to this repo before merging.

[gillisandrew]

@gmlewis Great! Thanks for your help and feedback, really appreciate it.

[tomfeigin]

Nice!

[gmlewis]

Thank you, @tomfeigin !
Merging.