Attach package materials to an attestation for reproducible builds

[AkihiroSuda]

Copying what we discussed in Slack here:

Example:

1. we make a buildkit release and push an image
2. a 3rd party downloads provenance for our release
3. it can now pull all the materials in that provenance and verify them offline if it wants to
4. it issues a rebuild with a special policy that doesn’t allow any outside images or new materials not in the policy. It can also drop the network completely.
5. it checks if it got the same artifact digest
6. if it did, then it issues a new (signed) attestation, confirming that our provenance was correct and is based only on our strictly defined sources
7. our image is now more trustworthy because trusted parties not related to us have verified it. It is impossible it was built from a a different Git commit or used apk package with a CVE for example.

Originally posted by @tonistiigi in #4238 (comment)