feat: support Evidence source provenance (EvidenceMapping) in provider API

[marcusburghardt]

Problem

The Gemara #Evidence schema includes a source field of type
#EvidenceMapping (evaluationlog.cue#L73,
auditlog.cue#L78-97)
that records where evidence was collected from -- which artifact,
which location within it, and a content digest for integrity pinning.

The go-gemara SDK already exposes this as Evidence.Source (EvidenceMapping
struct with fields ReferenceId, Coordinate, EntryId, Digest,
Remarks).

complyctl's gRPC provider API (api/plugin/plugin.proto) currently
carries only the basic evidence fields (id, type, description,
payload, collected_at) and explicitly defers the source field
with a comment referencing an unwritten "ADR 0023".

Without source, providers cannot report evidence provenance --
auditors and downstream consumers cannot trace an evidence entry back
to the specific artifact, file path, API endpoint, or Gemara entry
that produced it.

Proposed Solution

• Add EvidenceMapping proto message with fields reference_id,
  coordinate, entry_id, digest, remarks
• Add source field (type EvidenceMapping, field 6) to the
  existing Evidence proto message (backward-compatible)
• Add EvidenceSource struct to pkg/provider/client.go
• Plumb through proto mapping functions, evaluator, and Markdown
  formatter
• Update test provider for E2E coverage

References

• Draft PR with OpenSpec artifacts: feat: evidence source provenance (EvidenceMapping) support #840
• Provider-side adoption: tracked separately in complytime-providers
• Gemara schema: #Evidence in auditlog.cue, #EvidenceMapping in mapping_inline.cue