feat: add DSSE, in-toto v1, and SLSA v1.0 standard formats

[avrabe]

Summary

Implements industry-standard attestation formats for embedded signatures, addressing the gap identified in the codebase assessment.

What Changed

• DSSE envelope (src/lib/src/dsse.rs): Standard signing envelope format

  • Ed25519 signing and verification
  • Multi-signature support
  • JSON serialization compatible with cosign/sigstore-rs

• in-toto Statement v1.0 (src/lib/src/intoto.rs): Attestation framework

  • Statement, Subject, DigestSet types
  • ResourceDescriptor for dependency tracking
  • Standard predicate type constants

• SLSA Provenance v1.0 (src/lib/src/slsa.rs): Supply chain provenance

  • BuildDefinition with externalParameters/resolvedDependencies
  • RunDetails with builder identity and metadata
  • SlsaLevel enum (L0-L3)

New Composition Functions

// Embed signed SLSA provenance in DSSE format
embed_slsa_provenance(module, &provenance, &signer)?;

// Embed transformation attestation in DSSE
embed_transformation_dsse(module, &attestation, &signer)?;

// Extract for external tooling
let envelope = extract_dsse_attestation(&module)?;
// envelope is standard DSSE JSON - works with any DSSE tool

Benefits

Before	After
Custom JSON formats	Standard DSSE envelope
wsc-only parsing	Compatible with cosign, sigstore-rs
Separate section per type	Single wsc.attestation section
No SLSA format	SLSA v1.0 provenance ready

Extraction Example

# Extract attestation from WASM (future CLI command)
wasm-tools print module.wasm --custom wsc.attestation > attestation.json

# attestation.json is valid DSSE - verify with any tool
cosign verify-blob --bundle attestation.json ...

Test plan

• All 548 existing tests pass
• New DSSE tests (sign, verify, roundtrip, multi-sig)
• New in-toto tests (statement serialization, subject creation)
• New SLSA tests (provenance building, level comparison)
• CI validation