Add a bundle test for a dsse envelope containing an in-toto statement

[segiddins]

Summary

There are no bundle tests where "kindVersion":{"kind":"dsse","version":"0.0.1"} and the dsse envelope payload is an in-toto statement

Based on the example in https://blog.sigstore.dev/cosign-verify-bundles/

Release Note

Documentation

[woodruffw]

LGTM behaviorally, although I think we might want to rename the bundle here (if only because naming a file sha256:... will make it harder to visually distinguish between file inputs and hash-literal inputs).

[segiddins]

Any suggested names? I picked this since it's what gh attestation created

[woodruffw]

Any suggested names? I picked this since it's what gh attestation created

Hmm, maybe intoto-in-dsse-v3.sigstore.json? I admit that's not fantastic though.