feat(attestation): allow runtime annotations

[migmartri]

Support providing "attestation-time" material annotations.

For example, let's say that we have this contract

{
  "schemaVersion":  "v1",
  "materials":  [
    {
      "type":  "SBOM_CYCLONEDX_JSON",
      "name":  "skynet-sbom",
      "annotations":  [
        {
          "name":  "component",
          "value":  "controlplane"
        }
   
   ]
    },
    {
      "type":  "CONTAINER_IMAGE",
      "name":  "image",
      "annotations":  [
        {
          "name":  "component"
        }
      ]
    },
    {
      "type":  "STRING",
      "name":  "string"
    }
  ]
}

Note how the material called image is defining a component annotation but is not setting its value.

If you try to add the material without the annotation it will fail.

$ chainloop att add --name image --value ghcr.io/chainloop-dev/chainloop/control-plane 
ERR adding material: annotations ["component"] not provided

If you try to add an annotation not defined in the contract it will fail too

$ chainloop att add --name image --value ghcr.io/chainloop-dev/chainloop/control-plane --annotation foo=bar
ERR adding material: annotation "foo" not found in material "image"

or an invalid annotation

$ chainloop att add --name image --value ghcr.io/chainloop-dev/chainloop/control-plane --annotation foo
ERR invalid annotation "foo", the format must be key=value

but otherwise it can be set

$ chainloop att add --name image --value ghcr.io/chainloop-dev/chainloop/control-plane --annotation component=controlplane
INF material added to attestation

The result ends in the attestation as expected

[
  {
    "annotations": {
      "chainloop.material.name": "image",
      "chainloop.material.type": "CONTAINER_IMAGE",
      "component": "test" // IMPORTANT: Added on the fly
    },
    "digest": {
      "sha256": "97deaf8ad2e31524d6e7eee65468a4330cb55f7dcf4911ebdf2a580a4261c006"
    },
    "name": "ghcr.io/chainloop-dev/chainloop/control-plane"
  },
  {
    "annotations": {
      "chainloop.material.cas": true,
      "chainloop.material.name": "skynet-sbom",
      "chainloop.material.type": "SBOM_CYCLONEDX_JSON",
      "component": "controlplane" // IMPORTANT: Added by the contract
    },
    "digest": {
      "sha256": "ebe2e6ffab93f4b2e2743d3557bd094427ea059adc78cfe2cd330a72f61731e8"
    },
    "name": "sbom.cp.cyclonedx.json"
  },
  {
    "annotations": {
      "chainloop.material.name": "string",
      "chainloop.material.type": "STRING"
    },
    "content": "dGVzdA=="
  }
]

Refs #252

[danlishka]

LGTM