policy: add GitHub attestation verification

Add github_attestation and github_release_attestation policy support.
Fetch GitHub attestation bundles (including bundle_url .json.sn decode)
and verify against input.http.checksum.

Wire source metadata resolver progress through resolver options and add
ResolveState support for policy HTTP attestation fetches.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

policy/utils_test.go

@@ -66,6 +66,7 @@ func TestRuntimeUnknownInputRefs(t *testing.T) {
 		Unknowns: map[string]struct{}{
 			funcVerifyGitSignature:  {},
 			funcArtifactAttestation: {},
+			funcGithubAttestation:   {},
 		},
 	}
 	require.Equal(t, []string{"git.commit", "http.checksum"}, runtimeUnknownInputRefs(st))