Include guidance how to implement a secure builder

[MarkLodato]

We might want to include "implementation guidelines" to explain how builders should be implemented. This would both illustrate ideas to make them more concrete and also set expectations on level of security.

One thing from #504 is how a system of reproducible builds could satisfy SLSA Build L3.

[mlieberman85]

I think that guidance might also need to take into considerations constraints along with some pros and cons. In the tooling meetings we've been discussing what we think might make sense here. For example, storing attestations alongside artifacts vs. separately.