feat: Support attestation bundle URLs

[keeltrace]

GitHub REST API version 2026-03-10 returns artifact attestations using bundle_url instead of embedding bundle.

This keeps the existing Bundle field for older API/GHES responses, adds BundleURL, updates generated accessors, and updates the verification example to fetch bundle_url while retaining the legacy embedded-bundle fallback.

Part of #4077.

Testing/verification:

• generated accessor files are updated
• the previous staticcheck use of deprecated Attestation.Bundle is confined to the intentional legacy fallback
• fresh GitHub Actions for the current head are awaiting maintainer approval before jobs are created

AI-assisted contribution: ChatGPT helped inspect the migration issue, prepare the compatibility change, reconcile the generated files, and review the submitted diff. I reviewed the scope and exact changes before submission.

[gmlewis]

Please run step 4 in CONTRIBUTING.md and push the changes to this PR and then we can proceed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.57%. Comparing base (4340312) to head (b8f65fa).
⚠️ Report is 12 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4550      +/-   ##
==========================================
+ Coverage   98.53%   98.57%   +0.03%     
==========================================
  Files         195      197       +2     
  Lines       17851    18252     +401     
==========================================
+ Hits        17590    17991     +401     
  Misses        261      261              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.