Support changing slsa-verifier's options

[suzuki-shunsuke]

Feature Overview

Support changing slsa-verifier's command line options.

https://aquaproj.github.io/docs/reference/registry-config/slsa-provenance/

Why is the feature needed?

Some packages don't support --source-tag.

• Can't verify SLSA provenance with --source-tag xeol-io/xeol#210

Currently, options are static.

aqua/pkg/slsa/exec.go

Lines 73 to 82 in 70f84d6

	args := []string{
	"verify-artifact",
	param.ArtifactPath,
	"--provenance-path",
	provenancePath,
	"--source-uri",
	param.SourceURI,
	"--source-tag",
	param.SourceTag,
	}

How to reproduce the issue

No response

Workaround

If --source-tag isn't supported, we need to disable slsa_provenance, but this isn't desirable.

Example Code

registry.yaml

slsa_provenance:
  opts:
    - --source-uri
    - https://github.com/<foo>/<bar>
    - --source-tag
    - {{.Version}}

Reference

No response