Modernize provenance pkg to use the new intoto libraries

[puerco]

What type of PR is this?

/kind cleanup
/kind api-change
/kind failing-test
/kind flake

What this PR does / why we need it:

This PR updates the provenance package in bom to break the dependency on the deprecated in-toto-go libraries. This PR drops the old module and switches it to use the intoto attestation framework libraries.

Preparing to update the SLSA predicate version we are using, I've updated the Predicate wrapper to take any proto message internally and added a few new methods to translate to the different slsa versions.

The SPDX package has been updated to now use the provenance package.

Which issue(s) this PR fixes:

This change will allow us fix the breakages in other parts of the release tooling (eg kubernetes/release#4248) once it flows down.

Special notes for your reviewer:

/cc @kubernetes-sigs/release-engineering

Does this PR introduce a user-facing change?

- bom now uses the intoto attestation framework libraries, dropping the old in-toto-go module
- The provenance APIs have been generalized a bit, introducing a breaking change in some functions.

[k8s-ci-robot]

@puerco: GitHub didn't allow me to request PR reviews from the following users: kubernetes-sigs/release-engineering.

Note that only kubernetes-sigs members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

What type of PR is this?

/kind cleanup
/kind api-change
/kind failing-test
/kind flake

What this PR does / why we need it:

This PR updates the provenance package in bom to break the dependency on the deprecated in-toto-go libraries. This PR drops the old module and switches it to use the intoto attestation framework libraries.

Preparing to update the SLSA predicate version we are using, I've updated the Predicate wrapper to take any proto message internally and added a few new methods to translate to the different slsa versions.

The SPDX package has been updated to now use the provenance package.

Which issue(s) this PR fixes:

This change will allow us fix the breakages in other parts of the release tooling (eg kubernetes/release#4248) once it flows down.

Special notes for your reviewer:

/cc @kubernetes-sigs/release-engineering

Does this PR introduce a user-facing change?

- bom now uses the intoto attestation framework libraries, dropping the old in-toto-go module
- The provenance APIs have been generalized a bit, introducing a breaking change in some functions.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[cpanato]

Nice thanks

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cpanato, puerco

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [cpanato,puerco]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment