feat: Add BundleURL to Attestation

[Frank2006x]

Summary

Adds BundleURL *string to Attestation and adds omitempty to Bundle. The GitHub REST API for artifact attestations now provides
bundle_url to download the Sigstore bundle instead of returning the bundle inline.

This addresses the Attestations: Remove the bundle property from attestation list responses (users should use bundle_url instead). #4077 (comment).

part of #4077

Tests

go test ./github
script/test.sh
script/lint.sh

Assisted Contribution

Drafted with the assistance of an AI coding agent. All changes and test results were reviewed and verified against repository
guidelines.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.61%. Comparing base (af24e38) to head (d5618ce).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4647   +/-   ##
=======================================
  Coverage   98.61%   98.61%           
=======================================
  Files         199      199           
  Lines       18689    18694    +5     
=======================================
+ Hits        18431    18436    +5     
  Misses        258      258           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gmlewis]

Thank you, @Frank2006x!
LGTM.
Awaiting second LGTM+Approval from any other contributor to this repo before merging.

cc: @stevehipwell - @Not-Dhananjay-Mishra