feat: bundle attestations

[migmartri]

It's getting fairly common for build systems to output not only the artifact they are building i.e container image but also a in-toto attestation in the form of slsa provenance.

This provenance file can be signed and stored in an OCI registry using cosign, so similarly to #244, we could pull that data from the container image being attested in Chainloop.

This feature is two fold

• To be able to automatically retrieve att files associated with a container image. Obviously operators should be the ones deciding what container images should contain one, again, similarly to feat: being able to automatically pull and record attached SBOMS  #244
• To be able to bundle such attestation either as attestation bundle in-toto 1.0 support #60, as an artifact, or both.