verifying-source levels should match final source-requirements terminology

[zachariahcox]

This will be related to the general SLSA guidance of "trust the platforms, verify the outputs." We have some initial content in verifying-source.md

Originally posted by @zachariahcox in #1078