bug: fix incorrect policy evaluation

Attestation collections were incorrectly being considered to have passed
the policy if any of the attestations passed, even if others failed.
This was due to the collection being added to the Passed slice multiple
times for each attestation that didn't result in a failure.  Properly
breaking out of the inner loop and only considering a collection as
passed when all of it's attestations pass fixes the issue.

Signed-off-by: Mikhail Swift <[email protected]>

bug: temporarily turn off go mod proxy

Until we turn the repository public go proxy won't work since we're
still private. This will be turned back on once the repo is switched
public.

Signed-off-by: Mikhail Swift <[email protected]>

bug: adjust goreleaser main path

Signed-off-by: Mikhail Swift <[email protected]>

bug: fix go-releaser, add attestor option to Run from cmd

Few lingering things from the refactor -- go-releaser needs to point to
the updated location of main.go and I forgot to pass the attestors
through to witness.Run.

Signed-off-by: Mikhail Swift <[email protected]>

bug: fix go-releaser, add attestor option to Run from cmd

Few lingering things from the refactor -- go-releaser needs to point to
the updated location of main.go and I forgot to pass the attestors
through to witness.Run.

Signed-off-by: Mikhail Swift <[email protected]>

feat: OCI Attestor

Creats attestation on OCI images

Subjects:
- ContainerID
- Layer DiffID
- Tar Digest

feat: add nicer changelogs

Add support for reading configuration from file

Rename go package to github.com/testifysec/witness

Moving all development to github in preparation of the open source
release.

Rename go package to gitlab.com/testifysec/witness