Mechanism for retrieving log / older versions of metadata

[lizrice]

As things stand, only one version of each piece of metadata is accessible for a given image. For audit trails and the like, we may need some mechanism for versioning, including

• retrieving older versions (note these will persist in the registry as blobs anyway, so we just need to be able to maintain the references)
• retrieving an audit trail of who signed different versions (this may be awkward to retrieve from Notary?)