feat: add pypi attestation discovery

[benmss]

Summary

This PR adds discovery of PyPI attestation. URLs to these attestation files are sought via the deps.dev API.

Description of changes

• DepsDevRepoFinder was updated to use the DepsDevService, ensuring consistent and easily configurable use of the API
• Tests were added for DepsDevRepoFinder functions (they were not added previously), including for the functions that PyPI attestation discovery relies upon.
• PyPI attestations do not have a predicate. The pypi-attestation is used to extract information from the attestation certificate. This information is coerced into a predicate for use elsewhere within Macaron.
• Addition of an integration test case using the ultralytics Python library as its target.

Related issues

Closes #947

[tromai]

From the documentation for the predicate of https://docs.pypi.org/attestations/publish/v1/, currently its content is not defined. I wonder if the sourceUri and sourceDigest was copied from an existing implementation or it's purposely put here to catch these data if they are available in the future?
I have decoded the statement of https://pypi.org/integrity/ultralytics/8.3.119/ultralytics-8.3.119.tar.gz/provenance and got

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "ultralytics-8.3.119.tar.gz",
      "digest": {
        "sha256": "497bdcf3eb1beb082f451d42e5af2a6af944693a5991c78a9b9b0ce538593153"
      }
    }
  ],
  "predicateType": "https://docs.pypi.org/attestations/publish/v1",
  "predicate": null
}

[benmss]

I may have confused things by converting the certificate information into a predicate and attaching it to the pypi spec that has none. The type and the related function could be renamed to better distinguish them from the actual spec. The actual field names within the substitute predicate were chosen for simplicity, and loosely based on existing predicates I suppose.