docs: add commit finder tutorial using Arrow library

[benmss]

This PR adds a new tutorial demonstrating the capabilities and usage of the commit finder feature. It highlights how Macaron can report on differences between two versions of the same artifact by analysing the repository's related states. The Arrow Python library is used as a demonstration project.

Closes #500

[nathanwn]

Thanks for the tutorial. Here are some of my comments:

• I think the flow of the tutorial is fine. Showcasing the different results between two different versions is a good idea.
• I'm not so sure that the use of the term "artifact(s)" in different places would be more appropriate than "software component(s)". I think the latter could be more appropriate in certain places in the tutorial, given how Macaron works right now.
• A suggestion: I'm not sure if we have decided that this tutorial to just be about the macaron analyze command. If it is a standalone tutorial within its own page, and we decide that "macaron verify-policy should be part of every meaningful use case of Macaron", then there may be an argument for also going through a macaron verify-policy command. If that is the case, I would recommend the following policy, which I think is quite appropriate for the tutorial:

#include "prelude.dl"

Policy("has-build-service", component_id, "Require build with build scripts.") :-
    check_passed(component_id, "mcn_build_service_1").

apply_policy_to("has-build-service", component_id) :-
    is_component(component_id, purl),
    match("pkg:pypi/arrow.*", purl).

The policy named "has-build-service" here verifies if the software component with id component_id passes the "mcn_build_service_1" check. This policy is then applied to all software components having their PURL starting with pkg:pypi/arrow (i.e. they are a software component corresponding to some version of the Arrow package).

You can then also the output of the macaron verify-policy command to highlight the different analysis results.

2024-01-12 16:57:14,121 [INFO] Policy results:
component_satisfies_policy
    ['1', 'pkg:pypi/arrow@1.3.0', 'has-build-service']
component_violates_policy
    ['2', 'pkg:pypi/arrow@0.15.0', 'has-build-service']

This should be better than telling the user to "copy and backup the HTML file because it will be overwritten by Macaron", which sounds like an inconvenience created on Macaron's side. Doing it this way also better demonstrates how Macaron is "supposed" to be used, to some extent at least. Having said that, I think you should still showcase the HTML reports because it adds some visual elements to the tutorial.