fix: sometimes witness-run-action fails to connect to archivista

[kriscoleman]

Current behavior

Intermittently, when using witness-run-action in a github action, it will fail to connect to archivista with a ECONNREFUSED. Re-running the job usually will work on next attempt.

Run testifysec/witness-run-action@40aa4ef36fc431a37de7c3faebcb66513c03b934
Running in directory /home/runner/work/judge/judge
/usr/bin/sh -c witness run -a=environment -a=git -a=github --enable-archivista=true --fulcio=https://fulcio.sigstore.dev --fulcio-oidc-client-id=https://oauth2.sigstore.dev/auth --fulcio-oidc-issuer=sigstore --product-excludeGlob={web/node_modules/**,node_modules/**} -s=install --timestamp-servers=https://freetsa.org/tsr --trace=false --outfile=/tmp/install-attestation.json -- npm ci
level=info msg="Starting environment attestor..."
level=info msg="Starting git attestor..."
level=info msg="Starting github attestor..."
(string) (len=1844) "***"
level=info msg="Starting material attestor..."
level=info msg="Starting command-run attestor..."
npm ERR! code ECONNREFUSED
npm ERR! syscall connect
npm ERR! errno -[11](https://github.com/testifysec/judge/actions/runs/7790572883/job/21244726644#step:4:12)1
npm ERR! Error: connect ECONNREFUSED 104.16.29.34:443
npm ERR!     at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1555:16)
npm ERR!  Error: connect ECONNREFUSED 104.16.29.34:443
npm ERR!     at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1555:16) {
npm ERR!   errno: -111,
npm ERR!   code: 'ECONNREFUSED',
npm ERR!   syscall: 'connect',
npm ERR!   address: '104.16.29.34',
npm ERR!   port: 443
npm ERR! }
npm ERR! 
npm ERR! If you are behind a proxy, please make sure that the
npm ERR! 'proxy' config is set properly.  See: 'npm help config'

npm ERR! A complete log of this run can be found in: /home/runner/.npm/_logs/2024-02-05T20_40_10_154Z-debug-0.log
level=error msg="Error running command-run attestor: exit status 145"
level=error msg="failed to run attestors: exit status 145"
/home/runner/work/_actions/testifysec/witness-run-action/40aa4ef36fc431a37de7c3faebcb665[13](https://github.com/testifysec/judge/actions/runs/7790572883/job/21244726644#step:4:14)c03b934/node_modules/@actions/exec/lib/toolrunner.js:592
                error = new Error(`The process '${this.toolPath}' failed with exit code ${this.processExitCode}`);
                        ^

Error: The process '/usr/bin/sh' failed with exit code 1
    at ExecState._setResult (/home/runner/work/_actions/testifysec/witness-run-action/40aa4ef36fc431a37de7c3faebcb66513c03b934/node_modules/@actions/exec/lib/toolrunner.js:592:25)
    at ExecState.CheckComplete (/home/runner/work/_actions/testifysec/witness-run-action/40aa4ef36fc431a37de7c3faebcb66513c03b934/node_modules/@actions/exec/lib/toolrunner.js:575:18)
    at ChildProcess.<anonymous> (/home/runner/work/_actions/testifysec/witness-run-action/40aa4ef36fc431a37de7c3faebcb66513c03b934/node_modules/@actions/exec/lib/toolrunner.js:469:27)
    at ChildProcess.emit (node:events:513:28)
    at maybeClose (node:internal/child_process:1100:[16](https://github.com/testifysec/judge/actions/runs/7790572883/job/21244726644#step:4:17))
    at Process.ChildProcess._handle.onexit (node:internal/child_process:[30](https://github.com/testifysec/judge/actions/runs/7790572883/job/21244726644#step:4:31)4:5)

Expected behavior

witness-run-action witness connects to archivista without a ECONNREFUSED

let's implement github.com/kriscoleman/goretry to retry on transient errors.
we can use the convenience patterns so it's human readable