Add ec.fetch_oci_blob rego function

[lcarva]

It implements #1070, but it doesn't resolve it just yet. As a followup PR, I'll add acceptance tests to complete this functionality.

UPDATE: Acceptance tests are now included.

[codecov]

Codecov Report

Merging #1107 (0530d24) into main (976befd) will increase coverage by 0.08%.
Report is 23 commits behind head on main.
The diff coverage is 89.74%.

@@            Coverage Diff             @@
##             main    #1107      +/-   ##
==========================================
+ Coverage   84.16%   84.24%   +0.08%     
==========================================
  Files          63       64       +1     
  Lines        4988     5071      +83     
==========================================
+ Hits         4198     4272      +74     
- Misses        790      799       +9     

Flag	Coverage Δ
acceptance	69.63% <73.07%> (+0.06%)	⬆️
generative	4.50% <ø> (ø)
integration	18.91% <ø> (ø)
unit	76.86% <89.74%> (+0.22%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files	Coverage Δ
internal/fetchers/oci/client.go	73.17% <75.00%> (+0.44%)	⬆️
internal/evaluator/rego.go	91.42% <91.42%> (ø)

... and 1 file with indirect coverage changes

[zregvart]

I was wondering about the naming, and if ec.oci.blob could be a better name, or even if we want to push this upstream to OPA and have it opa.blob?
Some nitpicks inside, other than that 👍

[lcarva]

I was wondering about the naming, and if ec.oci.blob could be a better name, or even if we want to push this upstream to OPA and have it opa.blob?

Updated to go with ec.oci.blob.

I think you probably meant oci.blob on your second suggestion. If so, that sounds like a good upstream name if/when this function is part of opa itself. For now, since it is implemented in EC, let's make it super obvious that it is related to EC by having the ec. prefix.

[lcarva]

Caching is not working. I need to rethink the approach. Put it in draft for now.

[lcarva]

I'm gonna hold off on the cache approach for this PR due to google/go-containerregistry#1821.

[lcarva]

FYI, code coverage is failing to be uploaded. It is a known issue and it happens from time to time...