Add option to validate attestation Source Repository metadata

[igaskin]

Description

GitHub attestations also publish Source Repository metadata. example It would be useful to have the option to also check this metadata to validate, for example, the artifact was generated as part of a master branch (denoted by Source Repository Ref).

sample image policy snippet

    keyless:
      identities:
      - issuer: https://token.actions.githubusercontent.com
        subjectRegExp: ^https://github.com/github/artifact-attestations-helm/charts/.github/workflows/.*@refs/tags/trust-policies-v0.7.0$
        subjectSourceRef: refs/tags/trust-policies-v0.7.0 <--- suggested field addition.