SLSA SS.5: Source VSA content

Source VSAs use the VSA format: subject.uri should point a human to details of the revision and is not for policy decisions; subject.digest must carry the revision identifier (for example gitCommit) and may carry other content digests, and an SCS without cryptographic digests must define a canonical type for immutable revisions that includes the repository; subject.annotations.sourceRefs should list references pointing at the revision when attested, fully qualified for git (refs/heads/main, refs/tags/v1.0); resourceUri must be the repository URI, preferably as an SPDX download location; verifiedLevels must hold only the highest Source level met (SLSA_SOURCE_LEVEL_0 to 3) and may add properties; dependencyLevels may be empty. Organization-supplied properties must start with ORG_SOURCE_ (ORG_SOURCE_INTERNAL_ for ones not meant for outside consumers) and the SCS must enforce that prefix.