Support for checking in-toto attestations

[lulf]

Some build systems create in-toto attestations from various tools such as security scanners and store that metadata. Seedwing should provide patterns that can be used match in-toto attestations.

In seedwing, we should have:

• Functions that can verify Envelope signatures #143
• Add Patterns/Functions that can verify SPDX predicates #192
• Patterns/Functions that can be used to verify the SLSA statement and predicates #142
• A function that transform SLSA provenance + pattern into a SLSA verification summary #153
• Support keyid -> public key resolution for intoto::verify-envelope #170