feat(referrers): add public property

[migmartri]

The first part of #435

• It adds a relationship between the referrer and workflow since the visibility of a referrer is based the workflow's
• Now the returned entity contains a public property that indicates that it belongs to at least one workflow in the public state.

This means that the stored data now has visibility awareness, which will enable the support of the shared index #435

Example

This is an attestation in the index that belongs to a private workflow.

chainloop discover -d sha256:4b83ebba199499a1cbbd58517f5818d8e3fd56cb5cc244c26f4dd0729e2fccb2            

the result of the query is the attestation and references with public=false

{
   "digest": "sha256:4b83ebba199499a1cbbd58517f5818d8e3fd56cb5cc244c26f4dd0729e2fccb2",
   "kind": "ATTESTATION",
   "downloadable": true,
   "public": false,
   "createdAt": "2023-11-14T22:45:57.238998Z",
   "references": [
      {
         "digest": "sha1:586b1ce3fd6d0f64a09aa0cd7a58470517d558c7",
         "kind": "GIT_HEAD_COMMIT",
         "downloadable": false,
         "public": false,
         "createdAt": "2023-11-14T22:20:40.570963Z",
         "references": []
      },
      {
         "digest": "sha256:ebe2e6ffab93f4b2e2743d3557bd094427ea059adc78cfe2cd330a72f61731e8",
         "kind": "SBOM_CYCLONEDX_JSON",
         "downloadable": false,
         "public": false,
         "createdAt": "2023-11-09T10:45:14.353328Z",
         "references": []
      },
      {
         "digest": "sha256:ebe2e6ffab93f4b2e2743d3557bd094427ea059adc78cfe2cd330a72f61731e8",
         "kind": "ARTIFACT",
         "downloadable": true,
         "public": false,
         "createdAt": "2023-11-09T21:44:31.372575Z",
         "references": []
      },
      {
         "digest": "sha256:f1456d1cc4c943d3376716d3290ac4588f3f350f515543490b6930e4735ac043",
         "kind": "CONTAINER_IMAGE",
         "downloadable": false,
         "public": false,
         "createdAt": "2023-11-09T21:44:31.377839Z",
         "references": []
      }
   ]
}

Now let's update the visibility of the associated workflow

chainloop wf update --id c94a88f9-04bc-4a0e-b5c2-805ad73e6bb7 --public

Now the result is marked as public

{
   "digest": "sha256:4b83ebba199499a1cbbd58517f5818d8e3fd56cb5cc244c26f4dd0729e2fccb2",
   "kind": "ATTESTATION",
   "downloadable": true,
   "public": true,
   "createdAt": "2023-11-14T22:45:57.238998Z",
   "references": [
      {
         "digest": "sha1:586b1ce3fd6d0f64a09aa0cd7a58470517d558c7",
         "kind": "GIT_HEAD_COMMIT",
         "downloadable": false,
         "public": true,
         "createdAt": "2023-11-14T22:20:40.570963Z",
         "references": []
      },

and if you ask for a given artifact for example, you'll see that some associated attestations are public and some others are not, this is because they belong to different workflows with different visibility

[danlishka]

LGTM