feat: add rego policy for provenance checks

[silver-surfer94]

This pull request introduces changes to the policy governance and security, adding support for provenance attestations and modifying the test cases accordingly. The most important changes include the addition of provenance attestations in the governance policy, the creation of a new security.provenance package, and the addition of test cases for the new provenance rules.

Policy Governance Changes:

• policy/governance/governance.rego: Added provenance_attestations and provenance_violations to handle provenance attestations and violations respectively. The allow rule was also updated to include provenance_violations.
• policy/governance/governance_test.rego: The test case test_all_pass was updated to include data.test.provenance.

Security Policy Changes:

• policy/security/provenance.rego: Created a new security.provenance package with rules for handling provenance attestations.
• policy/security/provenance_test.rego: Added test cases for the new provenance rules in the security.provenance package.

Test Data Changes:

• test/provenance.json: Added a new test data file for provenance attestations.

Please note that these changes are crucial for the enforcement of provenance attestations in the policy governance.

[alexashley]

Another thing we're missing in the pipeline is conventional commit enforcement - can you change the PR title to use a conventional commit prefix? We can update the workflow in a separate PR.

[github-actions]

🎉 This PR is included in version 1.5.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀