Add artifact_attestation(http, filename) and wire verifier support for artifact bundle checks. Add docker_github_builder_bundle helper rule. Handle runtime unknown http.checksum after eval so metadata resolve is requested when checksum is missing. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>