Support push and pull signature

[FeynmanZhou]

As Notation verification workflow defined, Notation will support push and pull signature through the SDK capability of ORAS-go. It means notation-go has dependencies on the ORAS-go library.

Currently, we are working on these two dependencies in ORAS-go oras-project/oras-go#175 and oras-project/oras-go#205 to support push and pull signature artifact manifest with Notation.

[shizhMSFT]

oras-go rc.1 is released. We can start work this issue.

[dtzar]

This I believe we're deciding is not set until RC-2 per the linked user stories which we discussed on the last community call:
notaryproject/notation#245
notaryproject/notation#246

[yizha1]

As discussed in the community meeting on Nov 4, 2024, move this issue to future milestone.