Differentiate when a repo commit is found from the provenance vs tags

[behnazh-w]

It is very useful to differentiate when a repository and commit is found from the provenance vs registry metadata and repository tags because the former is more trustworthy. We can report that as a new check result.