API - Process attestations from commits

[ppazos]

Versions can have attestation information (electronic signature). If it is present, index it in the database and add logic to verify the signature of the document (at least to verify the document in the filesystem to check if it is corrupted).

[ppazos]

Besides processing attestations included in a compo committed for the first time, we also need to support change_type=attestation, that will create a new attested version of an existing non-attested composition and use the same attestation processing.