feat: add support for JFrog Artifactory and witness provenances produced on GitLab CI

[nathanwn]

This pull request adds the following features to Macaron:

1. Support downloading artifacts and provenances from a JFrog Maven package registry.
2. A new check for provenances produced by witness.

Note that these will only work for repositories built with Gradle for now. Support for Maven will be added later.

JFrog Maven package registry

A JFrog Maven package registry is a JFrog Artifactory instance that acts as a Maven repository. In SLSA terms, we call it a JFrog Maven package registry from here on out.

We are making the assumption that artifacts and provenances can be hosted on a JFrog Maven package registry. This pull request allows Macaron to discover artifacts and provenances on such a registry for analysis.

Another assumption is that an artifact and a corresponding provenance are hosted next to each other on the JFrog Maven package registry, i.e. if the artifact is hosted at https://some/url/of/groupid/artifactid/version/*.jar, then the corresponding provenance is hosted at https://some/url/of/groupid/artifactid/version/*.intoto.jsonl.

For Macaron to be aware of a JFrog Maven package registry, the user needs to provide the following section in the .ini config file:

[package_registry.jfrog.maven]
# In this example, the Maven package registry can be accessed at https://internal.registry.org/maven-repo.
domain = internal.registry.org
repo = maven-repo
download_timeout = 120

For Macaron to recognize a repository to possibly publish artifacts onto some JFrog Maven package registry, the repository must have Gradle as its build tool. Support for other build tools such as Maven will be added later.

The mcn_provenance_witness_level_one_1 check

This new mcn_provenance_witness_level_one_1 check is added as a witness-specific replacement for mcn_provenance_level_three_1, which currently only supports SLSA provenances generated by slsa-github-generator.

In this PR, this check only verifies that the digest of each jar file could be found somewhere in the corresponding witness provenance.

For this check to be effective, the following section must be provided in the .ini config:

# Witness provenance.
[provenance.witness]
# The allowed values of the `predicateType` field (data type: list).
predicate_types =
    https://witness.testifysec.com/attestation-collection/v0.1
artifact_extensions =
    jar

The following diagram shows a brief summary of the check's logical flow.