feat: add GitHub attestation discovery

[benmss]

This PR adds support for GitHub attestation discovery. To access GitHub attestations, the SHA256 hash of the repositories artefacts must be generated and submitted via the API. Artefacts may be found in local caches, or downloaded from remote repositories.

• [x] Support for Maven artefacts
• [x] Support for PyPI artefacts

Closes #915