Spike: Explore where in-toto attestations will go once they are created

Is your feature request related to a problem? Please describe.

We need to have a place that we can upload workload attestations into that is query-able and could be used for policy validation, auditing, and dashboarding by later UDS tooling.

Describe the solution you'd like

Given I have a workload that generates attestations (i.e. from witness)
When that workload runs
Then its attestations are uploaded to a central location in SWF

Describe alternatives you've considered

We could avoid attestations / in-toto but there is a lot of nice auditing capabilities that we would be missing out on without it.

Additional context

Something like Archivista (https://github.com/in-toto/archivista) could work for this and is already in the in-toto family - we could also look at simpler solutions nearer term as well though.

defenseunicorns / uds-software-factory