Add content verification

[judahrand]

We really should be doing content verification when we download data from the registry. I believe other ORAS implementations do and certainly tools like Docker, Podman, etc. do. The OCI Spec(https://specs.opencontainers.org/image-spec/descriptor) says:

Retrieved content SHOULD be verified against this digest when consumed via untrusted sources.

And then give guidance of what verification should check here.

Resolves #247

[vsoch]

These are not well placed - a Digest definition and helper functions do not belong in provider.py.

I'm guessing you asked the LLM to do this here. Let's simplify and just remove this final commit because it has a lot of problems.

[vsoch]

Oh this is a completely different PR.

These additions do not follow the conventions of the project. We have a specific module for types, and then functions to interact with them should be on the type. They do not belong in provider.py. Please check with the oras community about policy for using LLMs I'm not familiar - in other projects we have to add a line to the commit that code was assisted by Claude, etc.

[judahrand]

I'm guessing you asked the LLM to do this here. Let's simplify and just remove this final commit because it has a lot of problems.

I actually asked an LLM to do it, didn't like what it did and rewrote it myself for the most part so this wasn't really LLM authored 😅

I'll happily move the types around 🤷 I do think this is an important addition, however. I was honestly a bit surprised the project wasn't already doing it as other ORAS implementations do.

[vsoch]

I'm not up to speed, so we will need to ask @FeynmanZhou.

[judahrand]

Were you thinking that the types should live in oci.py? I've reworked the PR to do this and also moved that blob validation inside download_blob. Maybe this is more how you think it should work?