Specification for ORAS attach command

[sajayantony]

Currently the ORAS CLI has a command that pushes an reference type using the subject flag

oras push localhost:5000/alpine \
   --subject localhost:5000/alpine:3.9 \
   --artifact-type doc/example --plain-http \
    ./README.md

I would like to recommend moving this under a new command group attach and credit goes to @jdolitsky for showing this in the OCI working group.

The main idea idea here would be to support both the specification oras-artifacts and OCI reftypes.
The behavior can be determined using a few options -

1. Querying the extension API to see if we need to support ORAS or use OCI reftype
2. User passes in a flag like --update-index as per the propsal that might get finally approved.

For e.g.

oras attach --artifact-type doc/example \
       ./README.md \
        localhost:5000/alpine:3.9 \

@FeynmanZhou @shizhMSFT

[qweeah]

We should have a flag like --tag to support adding a tag for the newly created artifact manifest. Realized that attached manifest should not be tagged.

[FeynmanZhou]

@qweeah I see the current implementation as different from @sajayantony 's example. Is it consistent with our design?

oras attach localhost:5000/alpine:3.9  ./README.md --artifact-type doc/example 

[FeynmanZhou]

The current implementation of oras attach requires specifying a local file to attach annotations, this user experience is probably kind of cumbersome for users. We should support pass annotations as a String without specifying a file in 0.14.0.
After a discussion with @qweeah , this feature could be implemented along with oras push mentioned in #362.

[sajayantony]

I would also suggest we make the files optional since you don’t need files to attach annotations. Maybe one or the other can be required.