[feature] Support ingesting in-toto statements

[steiza]

Is your feature request related to a problem? Please describe. I was working with GUAC and ingested a provenance file, and then tried to ingest an associated SPDX SBOM. The SBOM was produced with syft 0.105.0, and did not contain a hash, making it hard to associate it with the previous provenance statement. I could at least pass --source-name to make the SPDX name match the provenance statement, but you have to be careful or these two items will not be associated with each other.

Describe the solution you'd like I really like in-toto statements, because they contain an explicit subject listing one or more associated artifact name(s) and digest(s). The in-toto statement can also contain a SPDX and CycloneDX predicate, which GUAC already understands how to parse.

Not everyone uses in-toto statements, but for those who do, GUAC's ingestion tooling could additionally handle that format. It would parse the SPDX or CycloneDX predicate contents just like it parses a stand-alone SBOM file today (with any existing associations it already knows how to create), and then add on additional associations based on the in-toto subject (I'm not 100% sure "associations" is the right word - whatever GUAC does internally to link pieces of information together).

Describe alternatives you've considered Another idea was to provide a way to tell ingestion tooling what artifact name or hash to associate with the information being provided. But this might create confusion when using the ingestion tooling to process many files associated with several different artifacts at the same time.

Additional context N/A