With the recent addition of SourceInfo etc, we are closer to generating
automated SBoMs, and to a reasonable degree, everything that should be
delegated to plugins has been delegated via the Source.collect_source_info()
and SourceFetcher.get_source_info() abstract methods, and the utility function
utils.guess_version() for version guessing.

This leaves some information which only users can explicitly provide in
their buildstream projects.

This patch adds some source level provenance information which users can
use to contribute to the SourceInfo.

Explanation of the changes in this patch:

  * types.py: Add internal _SourceProvenance object

    This validates and parses user provided source provenance
    information.

  * _loader/metasource.py: Now carry the _SourceProvenance

  * _loader/types.py: Add the Symbol.PROVENANCE for consistency,
    as the element and loader are using this to parse common
    format related symbols.

  * element.py: Load the _SourceProvenance from source nodes and
    pass those through to the MetaSource constructor

  * source.py:

    - Add the "homepage" and "issue-tracker" user provided source
      provenance attributes to SourceInfo, and include those in the
      SourceInfo serialization.

    - Automatically pass these attributes on to SourceInfo objects
      constructed with Source.create_source_info(), so that there
      is no plugin participation required

    - Update documentation about the addition of the `provenance`
      dictionary since 2.5

    - Adhere to the new MetaSource constructor in `Source.__clone_for_uri()`