This is a first pass at provenance generation for GitLab CI.

This is based loosely off of existing GitLab provenance documents:
https://about.gitlab.com/blog/2022/11/30/achieve-slsa-level-2-compliance-with-gitlab/
https://gist.github.com/wlynch/c7fd8f53adc77d3c0ec82356e4d43cb5

Currently this pulls values from environment variables.
I'm aware we want to pull this data from authenticated JWTs for
GitHub provenance, but I don't know what is in flight so I am starting
here for now, marking as v1alpha1 until we have more confidence in the
provenance spec.

SIGSTORE_ID_TOKEN.

OIDC docs.

This case is already covered in publish.js, so it was recommended that
this was removed.

Current theory is that this is causing the tests to fail, since the
library is picking up the real GitHub Actions runner when running in CI.

This data probably shouldn't be in environment, but this is where
similar data lives in the GitLab provenance spec today so it likely
makes the most sense to co-locate.

CI_BUILD_REF doesn't actually exist, CI_REPOSITORY_URL contains an
access token.

These values are a bit too much PII, so remove for now and only include
GITLAB_USER_ID and GITLAB_USER_LOGIN.