[Bug 2140708] New: Review Request: golang-oras - Work with OCI registries, but for secure supply chain