Strengthen git checks

[TomHennen]

@zachariahcox notes:

We should check that:

the repo is at the correct revision (git rev-parse head) is the same as the expected actions git sha
and that the checked out revision hasn't been modified (git status returns nothing)

Otherwise people might do something shady?

[TomHennen]

Question: is this actually required if the reusable workflow does the checkout? Would it even be possible for someone to mess with things?

[mlieberman85]

I'm assuming we're talking about during attestation generation? If so then yeah the reusable workflow would be the trusted actor and if someone could mess with the checkout then they could just as easily mess with git or the output of git.