Add repository artifact attestations

[espadonne]

Summary

• add repo artifact attestation storage, validation, upload/list/download routes, and Team gating for private org repos
• add the artifact_attestations entitlement and pricing comparison row
• document manual in-toto statement storage separately from deferred workflow-generated provenance

Tests

• go test ./internal/repos/attestations ./internal/entitlements ./internal/web/handlers/repo ./internal/web/handlers/orgs
• make ci