Downloading an OCI image from public AWS ECR using `tag` causes `mediaType` exception

It looks like when trying to download a debian image from AWS ECR: public.ecr.aws/debian/debian:latest, however, it looks like the manifest does not contain a `mediaType` field at the toplevel:
```
$ bazel query @debian//...
...
ERROR: An error occurred during the fetch of repository 'rules_oci~1.7.0~oci~debian':
Traceback (most recent call last):
File "/home/juan/.cache/bazel/_bazel_juan/72d38e88d392a1c0f4981c65e0bb0d1e/external/rules_oci~1.7.0/oci/private/pull.bzl", line 462, column 16, in _oci_alias_impl
if manifest["mediaType"] in _SUPPORTED_MEDIA_TYPES["index"]:
Error: key "mediaType" not found in dictionary
ERROR: : fetching oci_alias rule //:rules_oci~1.7.0~oci~debian: Traceback (most recent call last):
File "/home/juan/.cache/bazel/_bazel_juan/72d38e88d392a1c0f4981c65e0bb0d1e/external/rules_oci~1.7.0/oci/private/pull.bzl", line 462, column 16, in _oci_alias_impl
if manifest["mediaType"] in _SUPPORTED_MEDIA_TYPES["index"]:
Error: key "mediaType" not found in dictionary
```

Here's my MODULE.bazel file for reference:
```
bazel_dep(name = "rules_oci", version = "1.7.0")

oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")

# Declare external images you need to pull, for example:
oci.pull(
name = "debian",
# 'latest' is not reproducible, but it's convenient.
# During the build we print a WARNING message that includes recommended 'digest' and 'platforms'
# values which you can use here in place of 'tag' to pin for reproducibility.
tag = "latest",
image = "public.ecr.aws/debian/debian",
platforms = [
"linux/amd64",
"linux/arm/v7",
"linux/arm64/v8",
],
)

# For each oci.pull call, repeat the "name" here to expose them as dependencies.
use_repo(oci, "debian")
```

Running on: `bazel 6.4.0`

It seems to be able to pull fine if I provide the `digest`:
```
oci.pull(
name = "debian",
# 'latest' is not reproducible, but it's convenient.
# During the build we print a WARNING message that includes recommended 'digest' and 'platforms'
# values which you can use here in place of 'tag' to pin for reproducibility.
tag = "latest",
digest = "sha256:689ff332097aea20e4beff21741089a9a2957c5abf127ee2829b530b83ba3a12",
image = "debian",
platforms = [
"linux/amd64",
"linux/arm/v7",
"linux/arm64/v8",
],
)
```

```
$ bazel query @debian//...
...
buildozer 'set digest "sha256:79becb70a6247d277b59c09ca340bbe0349af6aacb5afa90ec349528b53ce2c9"' 'remove tag' 'remove platforms' 'add platforms "linux/amd64" "linux/arm/v5" "linux/arm/v7" "linux/arm64/v8" "linux/386" "linux/mips64le" "linux/ppc64le" "linux/s390x"' MODULE.bazel:debian

@debian//:debian
```

Reproduce the failure with the MODULE.bazel configuration and `bazel query @debian//...`, then inspect `oci/private/pull.bzl` around line 462 and the manifest handling used by the tag path. Done means the public AWS ECR image can be pulled by tag without the missing `mediaType` exception, while the documented digest configuration continues to work.

Written by the indexing model from the issue text.