(feat)Support native Tekton Artifacts API in SLSA provenance

[ngelman1]

Changes

Today, Chains generates SLSA provenance for TaskRuns by extracting input and output artifacts from type-hinted results -specially named results like *IMAGE_URL, *IMAGE_DIGEST, CHAINS-GIT_COMMIT, and *ARTIFACT_OUTPUTS. If a result name doesn't match the expected pattern, Chains silently ignores it.

This PR is wiring the Tekton native artifact API (TEP-0147) into Chains' SLSA provenance generation.
This allows steps to explicitly declare their inputs and outputs by writing a JSON file to $(step.artifacts.path). The Pipelines controller then populates status.artifacts and status.steps[].inputs/outputs on the TaskRun with structured data including URIs, digests, and a buildOutput flag.

Artifact mapping

Artifact field	buildOutput	SLSA provenance field
inputs[].values	n/a	resolvedDependencies
outputs[].values	true	subject
outputs[].values	false	byproducts

This does not replace type-hinting, but adds the ability of chains to fetch inputs and outputs, without forcing the user to exactly match naming convetions.

**Tested on a kind cluster

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• Has Docs included if any changes are user facing
• Has Tests included if any functionality added or changed
• Follows the commit message standard
• Meets the Tekton contributor standards (including
  functionality, content, code)
• Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings)
• Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

Chains now supports the native Tekton Artifacts API (TEP-0147) for SLSA provenance generation. Task authors can declare build inputs and outputs via `$(step.artifacts.path)` as an alternative to type-hinted results, with no naming conventions required.

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign infernus01 after the PR has been reviewed.
You can assign the PR to them by writing /assign @infernus01 in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.69%. Comparing base (1595398) to head (eca4358).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1841      +/-   ##
==========================================
+ Coverage   61.98%   62.69%   +0.70%     
==========================================
  Files          64       64              
  Lines        4067     4168     +101     
==========================================
+ Hits         2521     2613      +92     
- Misses       1265     1270       +5     
- Partials      281      285       +4     

Flag	Coverage Δ
unit-tests	62.69% <ø> (+0.70%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.