Filter frontend provenance attestations

[jedevc]

The frontend isn't allowed to create provenance attestations - only buildkit is allowed to do this.

We do the check in two stages:

• Verify in the solver that the frontend set a reason for generating the attestation, and then that reason wasn't for provenance
• Validate in the exporter (after unbundling) that the attestation predicate was valid for the specified reason. For now, we allow any SLSA provenance attestation for provenance and only allow SPDX for SBOMs.

[jedevc]

@tonistiigi in changing the tests to use SBOMs, I hit an issue with what I think is the history API?

=== RUN   TestIntegration/TestExportAttestations/worker=containerd/image
    client_test.go:6122: 
        	Error Trace:	/src/client/client_test.go:6122
        	            				/src/client/client_test.go:7252
        	Error:      	Should be true
        	Test:       	TestIntegration/TestExportAttestations/worker=containerd/image
=== RUN   TestIntegration/TestExportAttestations/worker=containerd/local
=== RUN   TestIntegration/TestExportAttestations/worker=containerd/tar
=== CONT  TestIntegration/TestExportAttestations/worker=containerd

[tonistiigi]

I'm not sure I understand these many commits changing the "attestation reason" handling. Iiuc we just need to check the predicate type does not match SLSA, unless attestation is made internally with ContentCallback. A simple for loop would do.

[jedevc]

Removed the reason handling, we just check against the SLSA predicate type now, in the same place where we do checking of Paths, etc.

The rest of the commits are minor fixups and checks that I found while writing the patch, that we should take as well - happy to split those up into a separate PR if neccessary.

[AkihiroSuda]

No need to check .. in the URL path?

I assume not needed, but posting this for confirmation

[jedevc]

I don't think we do - my understanding is that end-users should treat as essentially opaque strings and not attempt to resolve them: https://github.com/in-toto/attestation/blob/main/spec/field_types.md#TypeURI.

The only reason we do the strings.HasPrefix here instead of comparing directly against the strings in the in-toto library is to match against different versions (including unreleased ones).