fix(cache): verify attestation identity

[nandajavarma]

Summary

• replace WithoutIdentitiesUnsafe with Sigstore certificate-identity verification
• require the GitHub Actions OIDC issuer and the configured GitHub source repository
• add an optional exact --slsa-source-ref / LEEWAY_SLSA_SOURCE_REF restriction
• preserve strict-mode behavior: an identity mismatch rejects the cache entry and triggers a local rebuild

This closes the gap where an artifact with a valid signature from an unrelated signer could be accepted.

Follow-up

After this is released, gitpod-next will pin the new Leeway version and set LEEWAY_SLSA_SOURCE_REF=refs/heads/main for trusted main cache consumers.

Verification

• go test $(go list ./...)
• golangci-lint run --new-from-rev=HEAD ./...
• unit cases cover the trusted main signer, wrong issuer, wrong repository, pull-request ref, and missing repository claim
• git diff --check