Use Oras .NET library for interacting with OCI registries in Microsoft.NET.Build.Containers

[lbussell]

Background: Microsoft.NET.Build.Containers uses its own implementation of OCI models and registry interactions (example: ManifestListV2.cs)

We can migrate to the ORAS .NET library and delete a lot of the custom registry interaction code in the SDK. The ORAS .NET library has no external/3rd party dependencies and has an Apache-2.0 license. It's maintained by other Microsoft employees.

This work has a few parts that must be completed (roughly) in order:

• Migrate Microsoft.NET.Build.Containers to OrasProject.Oras in dotnet/sdk's main branch
• Add OrasProject.Oras to SBRP as an external project so that it is built from source as part of .NET's build.
• Flow SBRP to VMR in order to unblock SDK flow to VMR
• Complete SDK flow to VMR with new OrasProject.Oras dependency

/cc @baronfel

[tmds]

The current implementation is scoped to meet the SDK's needs.

The SDK does custom things (retries, auth, docker creds, ...). There would be work to make these work with ORAS.

Are there known issues that would be fixed by using ORAS?