Set docker image lineage and lifecycle annotations

[ghidalgo3]

Description

There are metadata annotations we must set to inform downstream image consumers of image deprecation dates and lineage.

I tried to call the ORAS CLI via its docker container but found it much too difficult to pass docker credentials to it, so we just install it on the host.

Type of change

Please delete options that are not relevant.

• New feature (non-breaking change which adds functionality)
• This change requires a documentation update

How Has This Been Tested?

Tested by running the cipublish several times, checked that:

1. When a new image is pushed, it receives a lineage annotation.
2. When an image replaces an existing image, the previous image receives a lifecycle annotation.
3. We check the existence of annotations to make sure we don't add duplicate annotations.

Checklist:

Please delete options that are not relevant.

• I have performed a self-review
• Documentation has been updated