Implement checking if the workflow that built the artifact is part of the allowed list

[rdimitrov]

The idea is to ensure that the workflow that built the artifact is part of the allowed actions list.

• Artifact is signed -> get it's signer identity (workflow) -> check if this workflow is allowed in GitHub

Reference:

• https://github.com/stacklok/minder-rules-and-profiles/blob/d1ef79da0cb3664d28a8bedfa890faf11e59718d/rule-types/github/allowed_selected_actions.yaml#L31