bump: update oras-go

[qweeah]

What this PR does / why we need it:
This PR bumps oras-go to include a fix for oci image layout.

Please check the following list:

• Does the affected code have corresponding tests, e.g. unit test, E2E test?
• Does this change require a documentation update?
• Does this introduce breaking changes that would require an announcement or bumping the major version?
• Do all new files have an appropriate license header?

[codecov-commenter]

Codecov Report

Merging #856 (2a782fe) into main (2d8dc21) will not change coverage.
The diff coverage is n/a.

📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more

@@           Coverage Diff           @@
##             main     #856   +/-   ##
=======================================
  Coverage   66.39%   66.39%           
=======================================
  Files          21       21           
  Lines         860      860           
=======================================
  Hits          571      571           
  Misses        243      243           
  Partials       46       46           

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[shizhMSFT]

LGTM