Git LFS support for git attestor

[matglas]

When attesting a git repo with lfs objects it shows files as being changed. But they are just checked out files. The attestation showing a changed state and all the lfs objects looks strange. Maybe it should check if the state of the lfs objects is correct based on the data in the repo. Just thinking out load.

[mikhailswift]

We use go-git for our git attestor and it looks like they currently don't support LFS:

https://github.com/go-git/go-git/blob/4f614891047bae5d0f7a253f014175505b9821d7/COMPATIBILITY.md?plain=1#L93

However, we may be able to contribute to go-git for this support, or investigate other solutions to!

[matglas]

As its mainly to get lfs status it could be enough to right a complementary status part into go-git just to verify lfs. I noticed from the issues they have on their go-git repo that git-lfs is not that ready for including it as a go module, even though their tooling is written as a go module. They have a pretty unstable API as they say themselves.

[colek42]

would the omnitrail stuff we are doing help here? cc @fkautz