Add attestation marshal tests

[KirtiRamchandani]

Problem
Artifact attestation payload types are shared by organization, repository, and user attestation APIs, but the shared resource structs did not have dedicated JSON marshal coverage tracked by #55.

Root cause
Existing service tests exercise API decoding paths, while the resource-level marshal round-trip tests skipped Attestation and AttestationsResponse.

Solution
Add marshal tests for empty and populated Attestation and AttestationsResponse values. The populated cases use the existing json.RawMessage comparator so Sigstore bundle JSON is compared semantically.

Tests run

• gofmt -w github/attestations_test.go
• go test ./github -run 'TestAttestation(sResponse)?_Marshal'
• go test ./github
• go test ./...
• git diff --cached --check

Linked issue
Part of #55