Support other ways of fetching or providing attestations

[asgrim]

At the moment, the only way we download attestations is from the GH API. However, since Sigstore is not GH-specific, we should provide other mechanisms of obtaining (or providing) attestations.