[in-toto] Add SLSA provenance support to in-toto-rs and rebuilderd

[nate-double-u]

rebuilderd is a verification system for binary packages. It repeates the build process of a package in an identical environment and verifies that the package is identical. It currently generates in-toto link attestations when a package is successfully rebuilt. As part of this task, rebuilderd must be updated to generate in-toto SLSA provenance. To enable this feature, in-toto-rs must be extended to support the provenance specification as well.

Mentor(s): Aditya Sirish (@adityasaky), Santiago Torres-Arias (@SantiagoTorres)

https://github.com/cncf/mentoring/blob/main/summerofcode/2022.md#add-slsa-provenance-support-to-in-toto-rs-and-rebuilderd