DSSE: Multi-subject test

[woodruffw]

Sigstore forbids multiple DSSE sigs, but mulitple subjects are perfectly fine (and are already present in the wild, thanks to GitHub's Artifact Attestations). The conformance suite should contain examples of these.

Some samples could easily be cribbed from homebrew-core's attestations, e.g.: https://github.com/Homebrew/homebrew-core/attestations/3628313

[loosebazooka]

Oh interesting, this is a v2 feature for the attestation action. v1 used to make separate files. Anyway, if we want something more generic (matching the artifacts already in testing), I have a repo setup to generate attestations: https://github.com/loosebazooka/aa-test/actions/runs/12187899996