docs: update provenance tutorial

[benmss]

Summary

This PR updates the npm provenance discovery tutorial to include the newer discovery methods: PyPI and GitHub.

Description of changes

• The tutorial is updated to provide examples of provenance discovery for PyPI and GitHub using the toga PyPI library, which has provenance of either type available for discovery depending on the exact version specified.
• For GitHub attestation, a small code update is included to allow the repository URL and commit digest to be found from provenance.
• The npm part of the tutorial is updated to use a newer version of the semver library 7.7.2