Add promotion record predicate type

[puerco]

This adds the Container Image Promotion Record predicate type. A predicate that records copies of container images between registries to ensure automated parties uploaded an image into an OCI registry. As per the spec:

This predicate type records the promotion of a container image from a staging
registry to a production registry mirror. It provides an auditable record of
when, where, and by what system an image was copied, enabling consumers to
verify the provenance chain of images served from production registries.

/cc @saschagrunert @cpanato @xmudrii

Signed-off-by: Adolfo García Veytia (Puerco) puerco@carabiner.dev

[saschagrunert]

• docs/new_predicate_guidelines.md require adding the new predicate to spec/predicates/README.md
• The docs/new_predicate_guidelines.md explicitly say 'a field named timestamp is too ambiguous; a better name would be builtAt or allowedAt or scannedAt'. A more descriptive name like promotedAt would follow the guidelines.

[saschagrunert]

The spec header says:

Type URI: https://k8s.io/promo-tools/promotion/v1

But the schema example uses: "predicateType": "https://in-toto.io/attestation/promotion-record/v0.1"

One needs to be picked and used consistently. If this is intended to live in the in-toto.io/attestation namespace, use the latter. If it's a Kubernetes-specific namespace, use the former. But then the version also needs to be consistent (v1 vs v0.1).

[puerco]

OK, I've evened them all to v1. I don't see a need to change this a lot in the foreseeable future. WDYT?

[saschagrunert]

Sounds good!

[puerco]

I've pushed a last commit that reorganizes the readme and adds this predicate. I also added SVR whcih was missing.

[puerco]

I had forgotten to rebase this, @in-toto/attestation-maintainers please take another look. Thanks!