Support pulling referrers from an image manifest

[FeynmanZhou]

What is the version of your ORAS CLI

ORAS v1.2.0-beta.1

What would you like to be added?

Provide a flag to enable users to pull referrers from an image manifest to local.

Why is this needed for ORAS?

In containers secure supply chain scenario, users may pull referrers (e.g. SBOM, signature, vuln scanning report) only without pulling a subject image. Suppose there is a large image with referrers in the registry, users may want to verify the supply chain metadata before pulling and using the image locally. It will reduce the performance and bandwidth cost.

Are you willing to submit PRs to contribute to this feature?

• Yes, I am willing to implement it.

[shizhMSFT]

Pre-requisite issues:

• Support customizing file name in oras pull #1159

Related issues:

• support --output - to pull to stdout #346
• Can pull referrer with oras pull without knowing the digest #834
• if an artifact cannot be pulled by oras pull, recommend oras user to use dedicated tool  #1177