Support for multiple Go builds

[laurentsimon]

Our current config file is inspired by goreleaser's config file but was simplified to show feasibility of the approach. We need to enhance the config file to support multiple builds.

One question to answer is how we will isolate each builds from one another. Note that the strategy.matrix field is not supported by the user workflow when calling a reusable workflow.

We can then include multiple Subject Digests inside provenance. See from https://github.com/gossts/slsa-go/issues/40

[laurentsimon]

Will need to support some level of parallelism/caching

[laurentsimon]

See slsa-framework/slsa-github-generator-go#51 as well.

[laurentsimon]

We need to decide the format of the output of the trusted builder: JSON or a zip files containing everything

Hopefully most users will use the auto-publish option slsa-framework/slsa-github-generator-go#58

[laurentsimon]

Note that goreleaser supports the following entries in their config file:

• binary:
• main:
• top-level env
• multiple ldflags
• ignore
• replacements

Support for these would greatly help teams adopt our SLSA builders, as it'd simplify migration