Add SLSA Level 3 and 4 verified history check

Design Plan:

• Only the merge and the linear commits of the user-defined branch will be considered into the check.
• If user does not supply branch name, the check will perform on all branches in the repository.
• [Issue] Currently, the check is unable to check the 2FA, since Github API does not allow fetching user's 2FA status,
• SLSA specification

Every change in the revision’s history has at least one strongly authenticated actor identity (author, uploader, reviewer, etc.) and timestamp. It MUST be clear which identities were verified, and those identities MUST use two-step verification or similar. (Exceptions noted below.)

[First-parent history] In the case of a non-linear version control system, where a revision can have more than one parent, only the “first parent history” is in scope. In other words, when a feature branch is merged back into the main branch, only the merge itself is in scope.
[Historical cutoff] There is some TBD exception to allow existing projects to meet SLSA 3/4 even if historical revisions were present in the history. Current thinking is that this could be either last N months or a platform attestation guaranteeing that future changes in the next N months will meet the requirements.

Start with the design plan and the cited SLSA specification, then review the GitHub API limitation around fetching two-factor authentication status. Clarify the branch and first-parent history rules, the historical cutoff, and how verified identities and timestamps will be established before implementation; the check is done when these requirements and exceptions are defined and covered.