Add 307 as valid response for pulling blobs

[sajayantony]

Fixes #397

[jdolitsky]

does this affect conformance tests at all, or are redirects simply followed? (i think they are)

[sudo-bmitch]

Redirects are followed automatically in Go (https://pkg.go.dev/net/http#Client). Does this need to be more generic than just on a blob GET, i.e. a statement at the top indicating http redirect status codes should be supported by clients according to https://www.rfc-editor.org/rfc/rfc7231#section-6.4

[jdolitsky]

Does this need to be more generic than just on a blob GET

That would seem to cover all bases here

[mikebrow]

hmm.. adding redirects to the spec probably requires further consideration.

Was there any progress on creating a WG for auth?

[tianon]

Was there any progress on creating a WG for auth?

opencontainers/tob#119

[sajayantony]

Closing this PR for now but will consider bringing up the issue during the call. Currently multiple clients already follow redirects but seems like this is intermingled with auth.