[rw] Add attestation metadata to CIPD packages
This change adds a function that attaches the attestation to uploaded
CIPD packages. This is how we are going to pass attestations to Android.
This isn't yet joined up to main.go. I need to think a little more
about the right injection point/API. That will be a different CL.
I ran `go mod tidy` and `go mod vendor`.
Bug: b/295932544
Change-Id: Ia27a134136f1ba1863c87badf0da361411dcb8fa
Reviewed-on: https://fuchsia-review.googlesource.com/c/infra/infra/+/928533
Reviewed-by: Nathan Mulcahey <nmulcahey@google.com>
Commit-Queue: Chris Lewis <cflewis@google.com>
7 files changed
