Change attestation annotations to follow OCI recommendations

Docs for the new Attestation Manifest Descriptor says:

To assist index traversal, the following annotations will be set on the manifest descriptor descriptor:

• vnd.docker.reference.type

This annotation describes the type of the artifact, and will be set to attestation-manifest. If any other value is specified, the entire manifest should be ignored.

• vnd.docker.reference.digest

This annotation will contain the digest of the object in the image index that the attestation manifest refers to.

When present, this annotation can be used to find the matching attestation manifest for a selected image manifest.

But OCI's rules for annotations says:

• Keys SHOULD be named using a reverse domain notation - e.g. com.example.myKey.

This is only a SHOULD, and there's no annotation police to throw you in OCI jail, but if it's not too late to change it, it might make sense to change the annotations to com.docker.reference.(type|digest), to follow OCI's naming guidance.

Start by locating the current uses of vnd.docker.reference.type and vnd.docker.reference.digest in the attestation implementation and its tests. Review the linked Attestation Manifest Descriptor documentation and OCI annotation rules. Done means the annotations follow the proposed com.docker.reference naming and related tests or documentation are updated.