Add skeleton for a metadata verifier

[rbehjati]

This is PR adds the skeleton for a metadata verifier for Amber provenances (AmberProvenanceMetadataVerifier) and calls it in ProvenanceBuildWrapper. This does not give a complete implementation for a metadata verifier, and is mainly intended to solve the problem of slow builds.

I have added a few TODO to identify the remaining work. In particular, we have to decide which fields need to be verified in the metadata verifier. The expected values should then be provided as input both to the verify command line tool, and to ProvenanceBuildWrapper, as well as the choice of the verifier (see #69).

[aferr]

This looks OK. I am wondering if after this change the ProvenanceBuildWrapper is still useful, and perhaps it is best to just deprecate it. It seems like what it checks is similar to what the ProvenanceWrapper checks, so we might not need both of these.

Probably, the ProvenanceBuildWrapper should eventually be replaced with something that gets the hash from github, at which point it really would have a distinct job from ProvenanceWrapper.

We could just deprecate the current slow ProvenanceBuildWrapper until we have the github one, but the change here does solve the CI slowdown issue, so what you have here is also fine.

[rbehjati]

Perhaps ProvenanceBuildWrapper and ProvenanceWrapper could be merged into a ProvenanceVerifierWrapper. But some verification is still needed, which is not done in ProvenanceWrapper.

With this change, it may seem like ProvenanceBuildWrapper is not doing any interesting verification. But as I have explained in a TODO (not exactly with this wording), ProvenanceBuildWrapper will have an instance of ProvenanceVerifier, and use that for verifying the provenance before emitting a statement.

To be more accurate, it might be better to also change hasProvenance to hasVerifiedProvenance in the auth-logic statement.

[mariaschett]

Thank you! :)

[mariaschett]

Maybe we want to indicate the todo also in the documentation of the func?

[rbehjati]

Thanks. Done.