Should checklevelprov be less strict about time?

[TomHennen]

checklevelprov doesn't consider the 'Control' Since time that GitHub reports. Instead it only considers what the previous provenance says.

That makes it pretty brittle in cases when we've lost provenance for some reason (like this tool that's in active development breaks ).

What if we add a --strict mode that if not enabled will take the older of the time reported in the prior provenance or the control time.

This should make things less brittle and help out if folks update their control but the provenance hasn't been lost.

[TomHennen]

With #103 the source provenance now records the times that controls have been enabled since according to the GitHub API.

It also records the earliest available 'provenance' time.

Policy verification still requires that all the controls have been enabled at least since the date listed in the policy.

This change may make it easier to address failure to generate provenance.