[feature] Re-enable material URI verification

[laurentsimon]

Temporarily disabled for https://github.com/gh-community/npm-provenance-private-beta-community/issues/8

[laurentsimon]

Below is the content of the issue description:

Seems like materials and configSource don't use the same URI:

{
  "_type": "https://in-toto.io/Statement/v0.1",
  ...
    "invocation": {
      "configSource": {
        "uri": "git+https://github.com/laurentsimon/provenance-npm-test@refs/heads/main",
       ...
        "entryPoint": "laurentsimon/provenance-npm-test/.github/workflows/release.yml@refs/heads/main"
      },
    ...
    "materials": [
      {
        "uri": "git+https://github.com/laurentsimon/provenance-npm-test",
       ...
      }
    ]

In all the fields, the URI = git+https://github.com/repo/name@<ref>. In the material, the <ref> is not present.
Is this intentional?

In the https://github.com/slsa-framework/slsa-github-generator repo, we always report the ref.