feat: Record vars in SLSA generators

[ianlewis]

Summary

Records the GitHub vars context in the SLSA invocation in the generic generator and container generator.

The vars context is passed to the "builder" binary as a JSON blob via the GITHUB_VARS environment variable. The values are then recorded in the invocation.parameters.vars field of the provenance predicate. Masking of inputs or vars is not supported.

Note that the vars context is set to the variables for the repository that initiated the GitHub Actions run and not the reusable workflow's repository.

Updates #1555

Testing Process

• Set a variable on the test repo
  • Go to Settings -> Secrets & variables -> Actions and then click on the Variables tab.
  • Set some test variables.
• Generate provenance as normal using the generic generator or container generator
  • Note that the compile-generator: true input must be set.
• Examine the invocation.parameters.vars field in the resulting provenance. The vars should be recorded there.

Checklist

• Review the contributing guidelines
• Add a reference to related issues in the PR description.
• Update documentation if applicable (added [docs] Add inputs to provenance examples #3627 to track)
• Add unit tests if applicable.
• Add changes to the CHANGELOG if applicable.