attestation: handle multiple subjects

[woodruffw]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew style with your changes locally?
• Have you successfully run brew typecheck with your changes locally?
• Have you successfully run brew tests with your changes locally?

---

GitHub's Artifact Attestations feature began putting multiple subjects in a single bundle yesterday. This broke our assumption that each attestation has only one subject. To fix this, we generalize our search of the attestation's subject from just the first subject name to any name in the subject set.

This should fix the behavior observed in Homebrew/homebrew-core#177384 (comment) and below.

See also: https://github.blog/changelog/2024-12-04-artifact-attestations-now-support-multiple-subjects/

[woodruffw]

(Draft while I shore this up.)

[woodruffw]

Tests are green locally, but I haven't added a new multi-subject test yet. I can do that in a moment, or with a follow-up.

Edit: Done.