Idea: ko rebase

When a newer version of a base image is available, in some cases you can pick up those updates without having to completely rebuild your image from scratch on top of the new base image. Instead, you can [rebase](https://github.com/google/go-containerregistry/blob/main/cmd/crane/rebase.md). It just so happens `ko` builds images that are amenable to rebasing. 👍

With [future improvements to the OCI spec](https://github.com/opencontainers/image-spec/pull/822) to declare standard annotations to signal base image information, [`crane` will be able to take advantage of these annotations](https://github.com/google/go-containerregistry/pull/960) to detect and rebase images without any external information required.

`ko resolve` builds a bunch of images, by default based on gcr.io/distroless/static:nonroot. If `ko` produced images that wrote base image annotations, it could also have a CLI surface to ingest YAML generated by a previous `ko resolve` to detect image references, determine base image information for those images, identify new available base image versions, perform a rebase, and replace image references in the output YAML.

The result would be a workflow like: `ko resolve > release.yaml`, wait for a distroless release, `ko rebase release.yaml > release.yaml`, and release.yaml would now include images based on the new distroless release, without having to rebuild anything at all, or even have access to the original source.

Start with the ko resolve workflow and the crane rebase documentation, then review the referenced OCI image-spec annotations and crane annotation support. Done means ko can emit base-image annotations and provide a rebase workflow that reads prior release.yaml output, updates images from a newer base, and writes the replaced references.

Written by the indexing model from the issue text.