Specification for ORAS attach command

[shizhMSFT]

Discussed in #407

^{Originally posted by sajayantony June 10, 2022}
Currently the ORAS CLI has a command that pushes an reference type using the subject flag

oras push localhost:5000/alpine \
   --subject localhost:5000/alpine:3.9 \
   --artifact-type doc/example --plain-http \
    ./README.md

I would like to recommend moving this under a new command group attach and credit goes to @jdolitsky for showing this in the OCI working group.

The main idea idea here would be to support both the specification oras-artifacts and OCI reftypes.
The behavior can be determined using a few options -

1. Querying the extension API to see if we need to support ORAS or use OCI reftype
2. User passes in a flag like --update-index as per the propsal that might get finally approved.

For e.g.

oras attach --artifact-type doc/example \
       ./README.md \
        localhost:5000/alpine:3.9 \

@FeynmanZhou @shizhMSFT

[qweeah]

Ack

[shizhMSFT]

@qweeah It is related to #326 and #379

[qweeah]

1. Querying the extension API to see if we need to support ORAS or use OCI reftype
2. User passes in a flag like --update-index as per the propsal that might get finally approved.

Since 0.14.0 is targeting for RC1, we should focus on providing attach capability for an RC1-compliant distribution and create a new issue for those two as long term solution.

[qweeah]

Need to support annotation for oras attach

[shizhMSFT]

Closed by #433