[feature] Use SLSA resource description's annotations to specify whether the resolvedDependencies were a source or other material

[asraa]

The container-based builder uses two resolved deps: one is the source, and one is the builder binary from this repository.

They are both represented as a ResourceDescriptor in the unordered ResolvedDependencies field of the SLSA v1.0 provenance.

My suggestions is to use an annotation "source" to hint at which was the source, so the slsa-verifier can make an informed decision.

We can keep the default behavior the same - that is, if there is only 1 resolved dep, use that as the source. if there are more than 1, we can use the annotations to narrow the list down.

This is a string-string map, so we can do something like

      "resolvedDependencies": [
        {
          "uri": "git+https://github.com/slsa-framework/slsa-github-generator@refs/heads/main",
          "digest": {
            "sha256": "d5a35d5f711ac09f4cc661ccc42a9c3f9a29a3b140b59239d6c193606063de45"
          }
        },
        {
          "uri": "git+https://github.com/slsa-framework/example-package@refs/heads/main",
          "digest": {
            "sha1": "b11ac9395b936cc5afcbc45112f48d66d85788b7"
          },
          "annotations":{
                "source": "true"
          }
         }
      ],

the verifier can check presence of a source key in the annotation map with the value true.

What do you think?

[laurentsimon]

SG. Let's add the same for BYOB then