Incorrect invocation.configSource.uri value for inferred provenance value.

How to replicate

Run this command:

macaron analyze -rp https://github.com/ben-manes/caffeine.git --skip-deps

Because this repository doesn't have a provenance that Macaron can detect, Macaron put an inferred provenance in the final JSON report.
The content of the JSON report of this analysis is as follow:

...
                             "invocation": {
                                "configSource": {
                                    "uri": "https://github.com/ben-manes/caffeine@refs/heads/None",
...

Description

The logic for generating the content of invocation.configSource.uri for the inferred provenance is located here:

predicate["invocation"]["configSource"]["uri"] = (
    f"{ctx.component.repository.remote_path}"
    f"@refs/heads/{ctx.component.repository.branch_name}"
)

In scenarios where the branch name is not available, the content of this uri will be incorrect

Suggestion

If the branch name is not available for this software component, we can use f"{ctx.component.repository.remote_path}" only without f"@refs/heads/{ctx.component.repository.branch_name}"

Start with src/macaron/slsa_analyzer/checks/build_as_code_check.py around the inferred provenance logic, then run the documented macaron analyze command against the caffeine repository. Check the generated invocation.configSource.uri when branch_name is unavailable; done means it no longer includes the literal None suffix while retaining the repository remote path.