Fix: restrict EnsureContent to the requested platform

[apostasie]

Hopefully fix #3866 (to be confirmed).

This is 5-minutes-slapstick patching, so, this one needs scrutiny.

[apostasie]

CI failure is #3908

[yankay]

Thanks @apostasie
It works 👍
/lgtm

(base) root@kay201:~/oss/nerdctl# ./_output/nerdctl  -n k8s.io image save -o /tmp/registry.k8s.io_pause_3.10.tar m.daocloud.io/registry.k8s.io/pause:3.10
(base) root@kay201:~/oss/nerdctl# du -sh /tmp/registry.k8s.io_pause_3.10.tar
324K    /tmp/registry.k8s.io_pause_3.10.tar

[apostasie]

Rebased.

[AkihiroSuda]

Thanks