FR: support multiple image locations in oci_pull

We are mirroring base images to local registry in order to improve availability. Unfortunately this either requires setting up of something like a transparent proxy registry or some kind of additional steps to be done before image is available in a bazel build.
To streamline the mirroring use case, It would be very useful to support multiple image locations, mimicking the "url-urls" pattern used in [http_* rules](https://bazel.build/rules/lib/repo/http)
Example:
```
oci_pull(
name = "distroless_java",
digest = "sha256:161a1d97d592b3f1919801578c3a47c8e932071168a96267698f4b669c24c76d",
images = [
"local.registry/mirror/distroless/java17",
"gcr.io/distroless/java17"
],
platforms = ["linux/amd64"], # Optional
)
```
Implementation should try to fetch images in provided order until one succeeds, failing only if all of them fails.
It should be an error if different digests are specified.
It is not clear if this should be also extended to `repository` and `registry` parameters.

Start at the oci_pull entry point and compare its image-location handling with the Bazel http_* url-urls behavior linked in the issue. Done means locations are tried in order, the rule fails only after all fail, and conflicting digests are rejected; the treatment of repository and registry remains resolved.

Written by the indexing model from the issue text.