Add download_url, iid to Attestation API payload

Why are we doing this work

As part of Polish the MVC end-to-end Attestation workflow (#577701 - closed) this issue concerns linking the download downloading from the "list" attestation api payload.

Relevant links

• Polish the MVC end-to-end Attestation workflow
• Previous MR: Resolve "Create Attestations List API"

Non-functional requirements

• Documentation: Documentation will be written within the API endpoint, will document as is normally done for API endpoints. See related Resolve "Create Attestations List API" for an example of this.
• Feature flag: [FF] slsa_provenance_statement -- Roll out feature flag to publish SLSA provenance statements
• Performance: Performance considerations were part of the design. See Polish the MVC end-to-end Attestation workflow for more info.
• Testing: unit testing/manual testing. See verification steps below.

Implementation plan

Once Add attestation download API endpoint (#578751 - closed) is complete, we can then make the following changes to the Attestation API payload:

1. Add the download_url attribute which should be the full path to the download API (minus host information). For example: /api/v4/projects/123/attestations/321/download
2. Add the iid attribute.

We do this in the lib/api/supply_chain/attestations.rb file, in the resource :projects.

Verification steps

1. Create the required attestations in production as required.
2. Retrieve the list page.
3. Ensure the list endpoint contains the two required endpoints: iid and download_url.