RebuildFailure attestation format

[wbxyz]

We need to define a format to communicate meaningful rebuild failures. This will provide an explicit signal to downstream consumers that we are failing to rebuild a package.

This will required some nuanced framing because not every RebuildFailure will indicate malicious code in the upstream. Some RebuildFailures will be due to a change in the build toolchain, or other benign development processes. However, this RebuildFailure attestation type will be our signal for alerting the community when a package contains malicious source that was not present in the upstream.

[wbxyz]

@msuozzo wrote a relevant doc discussing this topic here: https://docs.google.com/document/d/1eQRiQfH_3gG9-cxmp3GG9ev9XiPaGBHRFuU5xxKvJ6Q/edit?tab=t.0#heading=h.1j9dk9fb76ua