cleanup verifying-source content

[zachariahcox]

verifying-source needs some cleanup

• remove todo
• define "prove". should probably be "if it is possible to verify..."
• This should be "if repo meets level 1 and ..."
• level three. should be: "repos at this level produce signed attestations for some revisions."
• "For each repository you have" should be "for each repository in your dependency graph" ?

source controls

• remove the word "you" replace with "consumers"
• reword "If an organization has indicated that use of these these controls are part of their repository's expectations, consumers SHOULD verify that the process was followed for the revision they are consuming."
• clarify whether a "repo" or a "revision" is slsa level 3.
• typo "It MUST NOT be possible for a single actor to control more than one voting accounts." should be "account"
• typo: should be "actor" Should the organization discover that it issued multiple accounts to the same actors...
• clarify this section: https://github.com/slsa-framework/slsa/blob/main/docs/spec/draft/verifying-source.md#post-approval-changes-allowed
• clarify https://github.com/slsa-framework/slsa/blob/main/docs/spec/draft/verifying-source.md#review-every-single-revision, also requires relatively slow moving repos
• call this "please squash merge" maybe?

[zachariahcox]

based on our discussion today, it's unclear if this is needed for 1.1. It's needed for the source track, which may be later.