Honor custom signer identities during chain evaluation

[goutamadwant]

Closes #436.

Summary

• Reuse the attestation verifier configured by --expected-issuer and --expected-san when the GitHub backend evaluates prior attestations.
• Preserve the default SLSA workflow identity for callers that construct the backend without a verifier override.
• Add regression coverage for default, custom, and nil verifier configuration.

Problem

sourcetool.New already creates a verifier from the configured expected identity for its top-level attester. However, Backend.GetBranchControlsAtCommit creates another attester with attest.GetDefaultVerifier().

That second verifier rejects otherwise valid prior attestations signed by a caller's configured workflow identity. As a result, provenance and VSA controls do not carry forward during chain evaluation, and the computed SLSA Source level can remain at L1.

Implementation

The GitHub backend constructor now accepts optional backend configuration while retaining its existing default behavior. sourcetool.New builds one verifier and passes it to both the top-level attester and the GitHub backend. Chain evaluation therefore uses the same issuer, SAN, and alternate-SAN policy as direct attestation verification.

This does not broaden trust by default. Existing github.New(options) callers still receive attest.GetDefaultVerifier(), and a nil verifier option leaves that default intact.

Validation

• go test ./...
• go test -race -count=1 ./pkg/sourcetool/... ./pkg/attest/...
• go vet ./...
• go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.0 run ./...
• git diff --check

[puerco]

Thanks for fixing this @goutamadwant ! LGTM in general, the CI is failing because the tests are now running on go 1.27 and some of the generated content is out of date. Just give it a rebase and the CI should turn green.