fix: validate caller-supplied config descriptor in Pack/PackManifest

[TerryHowe]

What this PR does

When a ConfigDescriptor is supplied to Pack / PackManifest, the caller is responsible for pushing the config blob and populating the descriptor's Digest and Size. The library uses the descriptor verbatim and does not push the config blob in that path.

Previously, a partially-populated descriptor (e.g. only MediaType and Annotations set, with an empty Digest and zero Size) was accepted and produced a manifest referencing a non-existent config blob:

"config": {
  "digest": "",
  "mediaType": "application/vnd.custom.config.v1+json",
  "size": 0
}

Some registries (e.g. GHCR) accept such manifests while silently dropping the config descriptor's annotations, which is confusing to debug.

Change

• Add validateConfigDescriptor, which validates both the media type format and the digest of a caller-supplied config descriptor.
• Apply it in packManifestV1_0, packManifestV1_1, and the deprecated packManifestV1_1_RC2 paths. Callers now get an error wrapping errdef.ErrInvalidDigest instead of a silently-malformed manifest.
• Clarify the ConfigDescriptor godoc to state that the caller must push the config blob and populate Digest/Size.

Because this only rejects manifests that were already malformed, and oras-go v3 has not been released yet, this is not a breaking change.

Tests

Added Test_PackManifest_ImageV1_0_InvalidConfigDigest, Test_PackManifest_ImageV1_1_InvalidConfigDigest, and Test_Pack_ImageV1_1_RC2_InvalidConfigDigest. Full suite (go test ./...) passes.

Fixes #1236

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.12%. Comparing base (19db72b) to head (e170e78).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1237      +/-   ##
==========================================
+ Coverage   83.09%   83.12%   +0.02%     
==========================================
  Files          82       82              
  Lines        5834     5842       +8     
==========================================
+ Hits         4848     4856       +8     
  Misses        605      605              
  Partials      381      381              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.