verifying-source should discuss verifying all the commits directly on a protected ref

[zachariahcox]

Thanks for handling this one @adityasaky !
I think we can safely close it now with the merge of #1175

I'll track a slight follow up to handle the "but how to do know the rules were always followed?" question.

In verifying source, we talk about this, which is more about ensuring that a PR means the final revision was looked at.

I think we can add a new item there that says "all the revisions on the protected ref should have provenance".

That's pretty much begged question for these "rules continuity" topics. I'll track a follow up and take a crack at it.

Originally posted by @zachariahcox in #1136