Spike: Explore where in-toto attestations will go once they are created

[Racer159]

Is your feature request related to a problem? Please describe.

We need to have a place that we can upload workload attestations into that is query-able and could be used for policy validation, auditing, and dashboarding by later UDS tooling.

Describe the solution you'd like

• Given I have a workload that generates attestations (i.e. from witness)
• When that workload runs
• Then its attestations are uploaded to a central location in SWF

Describe alternatives you've considered

We could avoid attestations / in-toto but there is a lot of nice auditing capabilities that we would be missing out on without it.

Additional context

Something like Archivista (https://github.com/in-toto/archivista) could work for this and is already in the in-toto family - we could also look at simpler solutions nearer term as well though.

[ericwyles]

Selected Archivista for this and created a separate issue for tracking building that package: defenseunicorns/uds-package-archivista#3