Document limitations imposed by the platform

[TomHennen]

This tool implements the SLSA Source Track on top of features provided by GitHub. In some cases the experience isn't as good as we'd like due to limitations of GitHub.

Let's document those limitations here in the hopes they can be resolved. :)

[TomHennen]

It's currently hard to tell if a control was updated to make it more strict, less strict, or even disable it.

As a result the codebase currently takes the position that any update to the control might indicate it had previously been disabled. This could cause some difficulty in management of a repo making it appear the repo has lost control continuity when it really didn't. API improvements could likely make the ergonomics of managing controls easier while retaining control continuity.

[TomHennen]

Repo admins can currently unilaterially change or disable controls. This makes it difficult to assure consumers the producers intent was still being met and is not the result of a 'rouge' admin. Currently this is handled by requiring the repo to change the 'since' field in their policy, which is a public declaration that controls have changed, and we assume the org will notice this problem.

If the platform could be configured to require two parties to disable a control that would go a long ways towards making this solution stronger.

[TomHennen]

We may find some additional limitations as we work through finalizing the threat model document.