SLSA v1.0 verification support for npm packages built by the "Trusted Builder"

Verification support for the "Trusted Builder" as defined in [RFC-0049](https://github.com/npm/rfcs/blob/main/accepted/0049-link-packages-to-source-and-build.md#non-falsifiable-provenance-using-a-trusted-builder)