Add support for OCI artifacts

**Describe the problem/challenge you have**

OCI registries are increasingly used to distribute non-image content — `flux push artifact`, `oras push`, helm OCI charts, WASM modules, policy bundles. Pulling these with vendir today means either:

1. Using `image:` and hoping its filesystem-overlay extraction works against a non-image manifest, or
2. Scripting `oras pull` / `flux pull artifact` out-of-band and feeding the result back via `directory:` — which loses the digest lock and the Renovate-trackable shape that's the whole point of vendir.

**Describe the solution you'd like**

A first-class `ociArtifact:` source that pulls via the OCI distribution APIs directly, extracts each layer blob's `tar(.gz)` into `path`, and records the resolved digest in `vendir.lock.yml`. Auth reuses the `image:` source's docker-config model; cosign verification is opt-in.

```yaml
- path: vendor/k8s-schemas
contents:
- path: .
ociArtifact:
image: ghcr.io/home-operations/k8s-schemas
tag: latest
mediaTypes:
- application/vnd.cncf.flux.content.v1.tar+gzip
cosign:
certificateOidcIssuer: https://token.actions.githubusercontent.com
```

**Anything else you would like to add:**

- Natural implementation dep: [`oras-go`](https://github.com/oras-project/oras-go).
- Worth a separate source type rather than extending `image:` — artifacts have no overlay/whiteout semantics, advertise non-image config media types, and pull in artifact-only concerns like cosign that don't belong on the image path.

---
Vote on this request

This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.

👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"

We are also happy to receive and review Pull Requests if you want to help working on this issue.

Start by tracing the existing image source, its Docker-config authentication model, and vendir.lock.yml handling; then compare those paths with oras-go's OCI distribution APIs. Define the separate ociArtifact source around layer extraction, digest locking, and optional cosign verification, with completion shown by pulling the YAML example's artifact into path and recording its resolved digest.

Written by the indexing model from the issue text.