bugfix: impl: require at least one of the source ref/sha extensions#109

woodruffw merged 3 commits intomainpypi/pypi-attestations:mainfrom

ww/allow-missing-refpypi/pypi-attestations:ww/allow-missing-refCopy head branch name to clipboard