add annotations to git.head subject

[migmartri]

In #382 we added a git.head subject that contains the sha1 commit digest. It would be useful to also add additional information such as the author or the commit timestamp.

Since now in-toto subjects are resource descriptors, we could add annotations.

Note that this will require some refactoring from our end #60. This basically means

• move from slsa.attestation struct definitions to in-toto/attestation ones.
• Update our code to leverage resource descriptors as subject array