Verify that the repository inside the pubspec.yaml actually matches the uploaded code

[benthillerkus]

Looking through unrelated issues here on the tracker, it seems that at multiple times in the past this was being worked on, but I couldn't find an actual ticket for it.

There are some pitfalls to this, when it comes to generated code, but I think for most packages it should be no problem?

[sigurdm]

Yes we want to do something along these lines at some point.

We might want to do this as SALSA attestations and signatures instead of us validating the code. (https://slsa.dev/attestation-model#model-and-terminology)