feat: Add lockfile attestor

[fkautz]

This commit introduces a new lockfiles attestor to capture and attest
the contents of common lockfiles in the project. The changes include:

• Add new file attestation/lockfiles/lockfiles.go implementing the lockfiles attestor
• Update imports.go to include the new lockfiles package

The lockfiles attestor captures contents of various lockfiles such as
Gemfile.lock, package-lock.json, yarn.lock, and others. It stores the
information in a slice of LockfileInfo structs, allowing for flexible
handling of multiple lockfiles.

This feature enhances the project's capability to track and verify
dependency information as part of the attestation process."

[jkjell]

Overall, looks great to me. Do we want to add the lockfiles found as subjects to the attestations?

[fkautz]

sample subject:

    {
      "name": "https://witness.dev/attestations/lockfiles/v0.1/file:go.sum",
      "digest": {
        "sha256": "0b6248e43fe5840cdda792292e069f8cf4ecd95ae8d8e5e8ef582b485bc4b1a9"
      }
    },