Add support for SLSA provenance

[adityasaky]

Currently, rebuilderd can generate in-toto link metadata when a package is successfully rebuilt. However, in-toto has now introduced support for more specific attestation types, the first of which is SLSA provenance. By updating to this specification, rebuilderd can make more specific claims about the package rebuild process, and can better integrate with other parts of pipelines that are also generating SLSA provenance.

Linked to: in-toto/in-toto-rs#17

cc @kpcyrd