PEP 740: tweak JSON simple API prescriptions

[woodruffw]

Per discussion with @dstufft: this removes the embedded provenance objects from the simple API and replaces them with digest references, much like the simple index. This has the virtuous effect of reducing the amount of mostly chaff JSON that client API consumers will need to download.

The added Appendix 3 has further details, including a rationale and concrete numbers. These have also been shared in the discussion thread.

---

📚 Documentation preview 📚: https://pep-previews--3768.org.readthedocs.build/

[woodruffw]

Just leaving a comment here for myself: the PEP currently specifies that the "distribution name" goes into the attestation payload, but doesn't say anything about how that name is normalized. So we probably need some additional language in the PEP to say that sdist names get the PEP 625 treatment. Wheel names are already pre-normalized, although maybe we should also "ultranormalize" them to handle different postrelease spellings, etc.