feat: mock in-toto attestations query

[felipecruz91]

This PR mocks the in-toto attestations query in order to support local evaluation for the ssc-metadata-goal policy.

The MockGetInTotoAttestationsForLocalEval function does the following:

1. Consume the attestations from the SBOM struct.
2. Ignore those whose envelope's payload type is different from application/vnd.in-toto+json.
3. Base64-decode the envelope's payload to obtain the statement.
4. Ignore statement if not SPDX or provenance.
5. If the predicate type is SPDX add it to Subjects.
6. If the predicate type is provenance and the startLine property exists (i.e max mode) then add it to Subjects.