Ensure VCS entries are presented as attestations

[errordeveloper]

• fix a number of bugs introduces in #3 and cleanup the code
• the attestations are using custom predicate type, as it appears much more meaningful than SLSA Provenance v1.0
  • it should be possible to generate proper SLSA attestations once there is machinery for all desired predicates as well as unit tests etc
  • that is primarily because SLSA spec is complex and it's not clear which way how it should map to what is known to tape