feat: rules_oci support (#1)

This commit adds oci_images as a new element on k8s resources. Labels
should point to oci_image rules. The resolver will read the image digest
from the index.json file of each oci_image and replace the image
references in the yaml.

Limitations: currently only either oci images or docker images are
supported. This is just an artificial limitation and could probably be
removed.

Allow downloading prebuilt binary in kubectl toolchain (bazelbuild#253)

* Allow downloading prebuilt binary in kubectl toolchain

Addresses customer request to download v1.10.0 in bazelbuild#245 because
v1.10.0 can't be built from source.

* Address review comments

* Doc fix