Move source track VSA info to the VSA spec?

[TomHennen]

Eventually, I think this list should be moved closer to the VSA spec itself so that users can reference the schema and these specific requirements together.

Originally posted by @marcelamelara in #1094 (comment)

[zachariahcox]

@TomHennen is there much work left to do here?

I think the goal is to say:

SLSA has two main phases: data production and policy evaluation. 

Provenance attestations are data production. 
They are generated by authoritative sources, sources responsible for overseeing the claims to which they attest. 

"VSAs" are policy evaluations. 
A policy can be evaluated against the tamper-resistant provenance attestations to produce a policy decision. 
The organization uses VSAs to determine whether a specific artifact, package, repository revision is suitable for the next phase of the SDLC.