Unifying HandleAttestation behavior in ReviewGAP and ReviewISP

[ooq]

Is your feature request related to a problem? Please describe.
In review.go, HandleAttestation() is trigged:

• per policy per image in ReviewISP()
• per image in ReviewGAP()
  This creates confusion for understanding the logic.
  Is this intended? Should we fix this?

A larger issue/confusion is also that the loop order is inverted in ReviewGAP() and ReviewISP():

• outer loop is img, inner loop is policy, in ReviewGAP()
• outer loop is policy, inner loop is img, in ReviewISP()
  Is this intended? Should we fix this?

Describe the solution you'd like
A clear and concise description of what you want to happen.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

[aysylu]

Hey @ooq, could you please fill in the fields in the issue for more context to the readers?

[ooq]

Hi @aysylu, I just updated the issue. Half of it is actually me trying to understand the code.

also @nenaddedic who might chime in.