aqua / gh attestation verify support

[scop]

aqua-registry has had support for GitHub artifact attestations for a while, but there have been no entries with that included yet.

That's going to change once aquaproj/aqua-registry#32470 is merged, probably in a few months (see aquaproj/aqua-registry#32470 (comment) and aquaproj/aqua#3157 for reasoning for the delay). I'm sure there will be more coming up once the first ones are out.

Would be nice to have support for verifying those attestations in mise, like there is for slsa-verifier and cosign.

Ref

• https://github.com/aquaproj/aqua/blob/fa86daed182397900e71c097f310b9e96742490f/json-schema/registry.json#L252-L263 (note that signer-workflow with the dash is the deprecated spelling, already slated for removal in a future version, signer_workflow is the preferred one)
• https://github.com/aquaproj/aqua/blob/fa86daed182397900e71c097f310b9e96742490f/json-schema/registry.json#L547-L549