Match provenance's SBOM and SLSA tokens in common casings

What does this MR do and why?

I want provenance to accept the spellings its own rule uses, because its patterns reject SLSA, CycloneDX, SBOM, SPDX and in-toto. They took only the lowercase and capitalized forms, so a pipeline describing its "SLSA v1.0" attestation failed.

References

Related to #10 (closed), whose gate change brings signing projects to these assertions.

Standards affected

provenance: the two file-contains:.gitlab-ci.yml assertions for SBOM and SLSA accept the acronym and mixed-case forms. None is added or removed.

Exemption implications

None. No consumer reaches these assertions while the gate keys on *.lock.toml.

Test plan

• just guard passes locally
• just check passes locally (self-conformance)
• just build && just agent succeeds (full pre-deploy gate)
• If standards//check.sh changed: ran against at least one consumer repo to verify the assertion behaves as intended
• If templates/ changed: lifted into a consumer repo and confirmed the template renders correctly with placeholders replaced
• If design/ changed: rendered the showcase locally and visually inspected at multiple viewports

Reviewer checklist

• Voice is GitLab Inc. neutral (no solo-developer narrative, no decorative essays)
• No em-dashes in customer-facing prose
• No filler words ("comprehensive", "robust", "leverage", "seamless")
• Trailers present (Signed-off-by:, Changelog: if user-visible, AI-Assisted: if applicable)
• CODEOWNERS section matches paths touched
• If breaking for consumers, CHANGELOG entry calls it out and the schedule is realistic

An AI tool wrote this change and ran the checks above.