feat: Support attestation bundle URLs

[keeltrace]

GitHub REST API version 2026-03-10 returns artifact attestations using bundle_url instead of embedding bundle.

This keeps the existing Bundle field for older API/GHES responses, adds BundleURL, and updates the repository attestation test to cover both response shapes.

Part of #4077.

Testing: local Go execution was unavailable in the Keeltrace runner, so I did not claim local test results; repository CI is the executable verification for this submission.

AI-assisted contribution: ChatGPT helped inspect the migration issue, refresh the branch against current master, prepare the compatibility change, and review the submitted diff. I reviewed the scope and exact changes before submission.

[gmlewis]

Please run step 4 in CONTRIBUTING.md and push the changes to this PR and then we can proceed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.57%. Comparing base (4340312) to head (b8f65fa).
⚠️ Report is 12 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4550      +/-   ##
==========================================
+ Coverage   98.53%   98.57%   +0.03%     
==========================================
  Files         195      197       +2     
  Lines       17851    18252     +401     
==========================================
+ Hits        17590    17991     +401     
  Misses        261      261              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.