Add an API to resolve manifest lists

[cgwalters]

I wanted this in composefs-rs.

[gemini-code-assist]

Code Review

This pull request introduces a new API to resolve OCI manifest lists, correctly handling platform and tag matching. However, the implementation lacks safeguards against malicious input, making it vulnerable to infinite recursion (stack overflow) via circular index references and potential memory exhaustion (OOM) when formatting error messages for indexes with a very large number of manifests, both of which can be exploited for Denial of Service. Additionally, my review identified a critical compilation issue related to platform matching logic and a high-severity bug in how nested image indices are resolved. Addressing these points will improve the robustness, correctness, and security of the new API.

[cgwalters]

I condensed the tests a bit more

[jmarrero]

lgtm

[jlebon]

Hmm, this was merged over red.

error[E0658]: `let` expressions in this position are unstable
   --> src/lib.rs:712:24
    |
712 |                     if let Some(platform) = desc.platform().as_ref()
    |                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |
    = note: see issue #53667 <https://github.com/rust-lang/rust/issues/53667> for more information

MSRV is pinned to 1.86 but assuming we're tracking el9 could be bumped to 1.88 which stabilizes this.

[cgwalters]

Thanks for looking, that issue is partially in #61

I dropped the MSRV check entirely for now in that; but yeah we may need to re-add it at some point for our crates. If we do it needs to be done in a way that uses rust-version (the modern way).