WIP: add support for new Referrers API

[imjasonh]

Supercedes #1425 since I just wasn't feeling that PR, and I think enough changed in the acceptance of the spec changes that I wanted to start over.

API-wise I think this is pretty good, both in terms of remote.Referrers(name.Digest) and img.Referrers() and the CLI surface crane attach <ref> and crane referrers <ref> -f foo.txt -t sbom.

Everything should support fetching referrers for a manifest-by-digest that doesn't exist, and updating the manifest(-that-might-not-exist) when a manifest specifies a subject, going through the fallback tag flow and updating the index manifest, while deduping and sorting.

As with #1425 it needs tests, which will need pkg/registry support. A Walk method would be nice. Support for ArtifactManifest is commented out but mostly would be easy to add.

cc @jdolitsky

Progress toward #1434

[codecov-commenter]

Codecov Report

Merging #1455 (8d1dd7b) into main (7268da0) will decrease coverage by 1.32%.
The diff coverage is 28.96%.

@@            Coverage Diff             @@
##             main    #1455      +/-   ##
==========================================
- Coverage   73.31%   71.98%   -1.33%     
==========================================
  Files         115      118       +3     
  Lines        8772     9064     +292     
==========================================
+ Hits         6431     6525      +94     
- Misses       1696     1861     +165     
- Partials      645      678      +33     

Impacted Files	Coverage Δ
pkg/crane/attach.go	0.00% <0.00%> (ø)
pkg/crane/referrers.go	0.00% <0.00%> (ø)
pkg/name/digest.go	92.85% <0.00%> (-7.15%)	⬇️
pkg/name/ref.go	100.00% <ø> (ø)
pkg/v1/config.go	75.00% <ø> (ø)
pkg/v1/manifest.go	100.00% <ø> (ø)
pkg/v1/partial/with.go	64.53% <ø> (ø)
pkg/v1/remote/delete.go	58.62% <ø> (ø)
pkg/v1/remote/image.go	76.19% <0.00%> (-3.81%)	⬇️
pkg/v1/remote/index.go	69.10% <0.00%> (-2.25%)	⬇️
... and 14 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[github-actions]

This Pull Request is stale because it has been open for 90 days with
no activity. It will automatically close after 30 more days of
inactivity. Keep fresh with the 'lifecycle/frozen' label.

[jonjohnsonjr]

#1546