Add signing_method enum to SLSA attestations

What does this MR do and why?

Adds an explicit signing_method enum to SupplyChain::Attestation (slsa_attestations), recording whether an attestation was signed with public Sigstore infrastructure (sigstore) or a per-project local CA (local_ca, ADR 007).

Previously the plan was to infer the method from the presence of signing_certificate_id. As agreed in the discussion, that inference breaks after certificate revocation: the FK is ON DELETE SET NULL, so deleting a certificate would silently reclassify its local_ca attestations as sigstore. An explicit column keeps the record accurate.

Scope:

• Migration: add_column :slsa_attestations, :signing_method, :smallint, null: false, default: 0. No index (no query pattern yet). No backfill needed, the local CA write path is not merged yet (#603913), so every existing row is sigstore, which the default covers.
• Model: enum :signing_method, { sigstore: 0, local_ca: 1 }, prefix: true.
• Factory: the :with_signing_certificate trait now also sets signing_method: :local_ca, keeping certificate presence and method consistent in specs.
• Model specs for the enum values, the default, and the trait.

Out of scope: the write path (#603913 sets local_ca in the provenance publisher) and API exposure (deferred to the verification work, #603915). All usage remains behind the slsa_provenance_statement feature flag (default off).

Database

slsa_attestations is a small table (feature is behind a default-off flag). Migration output:

ci: == 20260914055420 AddSigningMethodToSlsaAttestations: migrating ===============
ci: -- add_column(:slsa_attestations, :signing_method, :smallint, {:null=>false, :default=>0, :limit=>2})
ci:    -> 0.0034s
ci: == 20260914055420 AddSigningMethodToSlsaAttestations: migrated (0.0128s) ======

Rollback verified locally (db:rollback STEP=1 then re-migrate).

References

• Resolves https://gitlab.com/gitlab-org/gitlab/-/work_items/628890
• Discussion that decided on the explicit enum: https://gitlab.com/gitlab-org/gitlab/-/work_items/628422
• Parent epic: https://gitlab.com/groups/gitlab-org/-/work_items/22313 (Build Security Beta)
• ADR 007: https://handbook.gitlab.com/handbook/engineering/architecture/design-documents/slsa_level_3/decisions/007_attestations_private_dedicated_self_hosted/
• Prior MRs: !252696 (merged) (signing certificate model), !253258 (merged) (attestation FK)

Screenshots or screen recordings

Not applicable, no UI changes.

How to set up and validate locally

1. Run the migration:

   bundle exec rails db:migrate

2. In rails console, verify the default and predicates:

   a = SupplyChain::Attestation.new
   a.signing_method_sigstore? # => true
   b = SupplyChain::Attestation.new(signing_method: :local_ca)
   b.signing_method_local_ca? # => true
   SupplyChain::Attestation.signing_methods # => {"sigstore"=>0, "local_ca"=>1}

3. Run the model specs:

   bundle exec rspec spec/models/supply_chain/attestation_spec.rb

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.