feat: enable registry to store subject reference with OCI manifests

What does this MR do?

• Update OCI manifest schema with Subject field
• Add subject_id to manifest SQL
• Update manifest handler to allow subject to be set in manifest push workflow
• Return subject_id in manifest pulls

Other notes

The definition of (ocischema.Manifest) References() was updated to include descriptors in the Subject field, if present.

• One consequence of this is that the Subject is checked along with other refs in the manifest, and if the Subject is invalid/missing, the error will propagate to the handler resulting in a 400 response.
• This diverges from the OCI spec which states the PUT manifest endpoint should return 404 on error - see endpoint spec here.
• In this respect, the registry is already off spec since the Put Manifest handler only returns 400 on errors (to the best of my knowledge). Fixing this - or making it OCI-specific - is, I believe, beyond the scope of this issue.

Related to #967 (closed)

Author checklist

• Feature flags
  • Added feature flag:
  • This feature does not require a feature flag
• I added unit tests or they are not required
• I added documentation (or it's not required)
• I followed code review guidelines
• I followed Go Style guidelines
• For database changes including schema migrations:
  • Manually run up and down migrations in a postgres.ai production database clone and post a screenshot of the result here.
  • If adding new queries, extract a query plan from postgres.ai and post the link here. If changing existing queries, also extract a query plan for the current version for comparison.
  • Do not include code that depends on the schema migrations in the same commit. Split the MR into two or more.
• Ensured this change is safe to deploy to individual stages in the same environment (cny -> prod). State-related changes can be troublesome due to having parts of the fleet processing (possibly related) requests in different ways.

Reviewer checklist

• Ensure the commit and MR title are still accurate.
• If the change contains a breaking change, apply the breaking change label.
• If the change is considered high risk, apply the label high-risk-change
• Identify if the change can be rolled back safely. (note: all other reasons for not being able to rollback will be sufficiently captured by major version changes).

If the MR introduces database schema migrations:

• Ensure the commit and MR tittle start with fix:, feat:, or perf: so that the change appears on the Changelog

If the changes cannot be rolled back follow these steps:

• If not, apply the label cannot-rollback.
• Add a section to the MR description that includes the following details:
  • The reasoning behind why a release containing the presented MR can not be rolled back (e.g. schema migrations or changes to the FS structure)
  • Detailed steps to revert/disable a feature introduced by the same change where a migration cannot be rolled back. (note: ideally MRs containing schema migrations should not contain feature changes.)
  • Ensure this MR does not add code that depends on these changes that cannot be rolled back.

Related to #967 (closed)