Map a commit sha to an artifact and provenance

[behnazh-w]

Macaron can analyze a specific <branch, commit sha> of a repo. However, the provenance analyzer looks for the provenance in the latest release. We need to search the releases to match the provided commit sha if possible and analyze the corresponding artifact and provenance. We can add an optional artifact version input to assist the search.

If we cannot find such mapping, we can fall back to analyze the latest release and analyze the repo with its corresponding <branch, commit sha>.

[behnazh-w]

Once we complete this enhancement to map artifacts/provenances to a commit sha, issues like this one would be avoided because we would analyze the artifact corresponding to the specified commit sha in e2e test configurations (and not just the latest release artifact).

[behnazh-w]

This issue can be closed as the commit finder maps the artifact to commits.