SLSA verifier as a service

[laurentsimon]

To make the verifier accessible to everyone easily, we could have a REST/gRPC API to verify as a service. Possible use cases:

• OSSF or another org runs a verifier as a service. Note that this requires more thoughts w.r.t authenticity of the results. TLS interception does happen, so we ought to think about signing the results. This quickly becomes complicated if we want to support key rotation.
• Someone wants to deploy a service on their k8 cluster. Same question here around authenticity of the results. May need some sort of workload identity support
• Someone wants to deploy a service on their own infra, using a container image