[feature][npm] Verify the package name in the tarball

[laurentsimon]

See https://github.com/slsa-framework/slsa-verifier/pull/495#discussion_r1116675186

This requires changing the interface, and would probably not work as a service since the tarball would not be transmitted.

[laurentsimon]

More info at https://github.com/gh-community/npm-provenance-private-beta-community/issues/13 Looks like today, tarball content is not verified by the registry, but it may happen in the future.

[ianlewis]

would probably not work as a service

We can probably expect that any service clients do this themselves. For npm packages this means a thicker client than we would like but it seems necessary.