add reference for gitlab caching issue

Author: paulsavoie

docs/slsa-attestations/definitions.md

@@ -141,7 +141,7 @@ Guarantee: If the provenance is signed by SignPath, the build was executed on a
 | Azure DevOps   | Cache usage has to be explicitly defined in the pipeline definition and cannot be shared across pipelines or branches (see [the official documentation](https://learn.microsoft.com/en-us/azure/devops/pipelines/release/caching?view=azure-devops&tabs=bundler#cache-isolation-and-security))
 | GitHub Actions | Cache usage has to be explicitly defined in the workflow definition (see [the official definition](https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching))
 
-<!--| GitLab CI/CD   | TODO: https://docs.gitlab.com/ci/caching/-->
+<!--| GitLab CI/CD   | TODO: https://docs.gitlab.com/ci/caching/, see SIGNVM-114-->
 
 {:.quote}
 > The build platform MUST NOT open services that allow for remote influence unless all such interactions are captured as externalParameters in the provenance
@@ -155,4 +155,4 @@ Guarantee: If the provenance is signed by SignPath, the build was executed on a
 
 ## The `resource-uri` field
 
-A Verification Summary Attestation (VSA) document defines a `resource-uri` field, with the intention to communicate an URI where the software artifact can be retrieved. This information is rarely known ahead of time for all artifacts that are published outside an e.g. app store or package manager repository. SignPath instead provides, in accordance with the SLSA specifications, information identifying the software publisher.
+A Verification Summary Attestation (VSA) document defines a `resource-uri` field, with the intention to communicate an URI where the software artifact can be retrieved. This information is rarely known ahead of time for all artifacts that are published outside an e.g. app store or package manager repository. SignPath instead provides, in accordance with the SLSA specifications, information identifying the software publisher.