attestation: migrate emitted in-toto statements to v1

[crazy-max]

follow-up:

• provenance slsa v1 #6005 (comment)
• Migrate to in-toto v1 #4269

Emit in-toto Statement v1 for attestations while keeping compatibility for decoding legacy v0.1 statements.

First adds a small local JSON compatibility wrapper around the in-toto v1 protobuf types and isolates protojson handling at the attestation boundary. Then switches the exporter-side attestation paths to use that wrapper for statement creation, marshaling, and unbundling.

Compatibility is preserved on the read path. The new wrapper still accepts legacy https://in-toto.io/Statement/v0.1 JSON so bundled attestations and older fixtures can still be decoded. The write path always normalizes emitted statements to https://in-toto.io/Statement/v1.

It does not introduce a broader protobuf refactor across unrelated packages, and it doesn't add a new schema generation pipeline. The only new abstraction is the small attestation JSON wrapper that keeps the protojson requirement contained.

There are a few remaining github.com/in-toto/in-toto-golang usages outside the new wrapper path that are only used for constants or in tests, and those could be looked at as follow-up. The bigger remaining dependency on in-toto-golang is the SLSA provenance predicate modeling in the solver path, and switching that to github.com/in-toto/attestation would be a meaningfully larger protobuf-backed refactor that is better handled on its own.

Example: https://oci.dag.dev/?blob=crazymax/buildkit@sha256:7b1f485c470d4db8d7f244c369970b45a67f0ee92f52ac5f16fba09389649c11&mt=application%2Fvnd.in-toto%2Bjson&size=2249