Integrate in-toto (link attestations) with rebuilderd

[joyliu-q]

The following PR is part of the Google Summer of Code 2021 program.

The in-toto GSoC project is to develop in-toto-rs capabilities to support rebuilderd (Issue in-toto/in-toto-rs#4), which includes two parts:

1. Add runlib.rs; implement link generation using in_toto_run.
2. Use in_toto_run and link generation within rebuilderd.

This PR addresses part 2.

Features

• Make relevant changes to rebuilderd.db with SQL migrations (add has_attestation field to packages, remove attestation field from packages, and add attestation to builds to store link attestation)
• Update models to reflect db changes
• Integrate in_toto_run function to run and generate link attestation based on rebuild with contextual link name
• Store attestation and has_attestation in DB when Build is good
• Create API endpoint for rebuilderd to get link attestation data from db.

[adityasaky]

Updated the base branch to avoid merge littering when we want to upstream it later.

[adityasaky]

Marked this as ready for review based on the demo today, @joyliu-q. I'm going to take a look at it in a bit, do you have anything to push up to this one? 😄

[adityasaky]

This looks great, @joyliu-q, excellent work! I have some minor nits. Please note as a rule of thumb that it's better to keep the changes in a PR strictly related to the subject at hand. I think some formatting changes have crept in here, and they can litter the history of those lines of code.

[SantiagoTorres]

LGTM, modulo two very small nits!

[adityasaky]

LGTM, save the as yet open comments about autoformatting + in-toto version in the manifest. Great work, @joyliu-q!

[adityasaky]

LGTM again, @joyliu-q, thanks for cleaning up the history :)