[RFC-0003] Add commands for managing OCI artifacts

[stefanprodan]

This PR adds commands to the Flux CLI for managing OCI artifacts as described in the RFC Flux OCI support for Kubernetes manifests.

OCI artifact commands

$ flux push artifact oci://ghcr.io/org/repository/app-config:v0.0.1 \
	--path="./manifests" \
	--source="$(git config --get remote.origin.url)" \
	--revision="$(git branch --show-current)/$(git rev-parse HEAD)"

$ flux tag artifact oci://ghcr.io/org/repository/app-config:v0.0.1 --tag latest --tag production

$ flux list artifacts oci://ghcr.io/org/repository/app-config

$ flux pull artifact oci://ghcr.io/org/repository/app-config:latest --output ./tmp

$ flux build artifact --path ./manifests --output ./tmp/artifact.tgz

For authentication purposes, all flux <verb> artifact commands are using the ~/.docker/config.json config file and the Docker credential helpers.

The artifacts create with flux push artifact are annotated with the standard OCI annotation keys:

• org.opencontainers.image.source
• org.opencontainers.image.revision
• org.opencontainers.image.created

OCI repository commands

$ flux create source oci podinfo-oci \
--url oci://ghcr.io/stefanprodan/manifests/podinfo \
--tag 6.1.6 \
--interval 10m

$ flux create kustomization podinfo-oci \
--source=OCIRepository/podinfo-oci \
--path="./kustomize" \
--prune=true \
--interval=5m \
--target-namespace=default \
--wait=true

$ flux get sources oci
$ flux reconcile source oci podinfo-oci
$ flux suspend source oci podinfo-oci
$ flux resume source oci podinfo-oci
$ flux export source oci podinfo-oci
$ flux delete ks podinfo-oci --silent
$ flux delete source oci podinfo-oci --silent

[kingdonb]

I will look for somewhere better to put this information, but so as to not lose it for now, since I have written it out, I'll put it here:

Link to the docs that show how to create the free-standing "manifests" package repo and associate it with upstreams that can write OCI artifacts in actions runners from a separate repo.

The best way I know how to do this today is (kludgy, hope there is a better way)

Create a GITHUB_TOKEN (PAT) with packages:write and use docker login and flux push to push a first tag, implicitly creating the package repo. Then go to the page for the package which you can find on your GitHub profile, and set the visibility if needed and the permissions there, to allow actions to write from the source repository, as so:

Each manifests/podinfo or manifests/... is a separate package repo in GitHub, so you can keep these permissions isolated and granular, rather than free-for-all "everybody write into this bucket" approach.

You still need to set permissions.packages: write as above also. We should explain why this is needed in this example and why it is not needed in the following example, since it's not clear without any comment, or at least point to the docs that explain, here is my impression of why:

Pushes to a branch do not confer "write packages" permission by default in the GitHub permission model, because branches are not releases. Pushes to a tag do confer those permissions because tags are used for releasing.

[darkowlzz]

LGTM!