chore: validate input repo, commit, provenance to ensure they match

[benmss]

Adds a validation step to analysis that ensures the passed repo and commit match those found in the passed provenance, if all of those exist.