Official image provenance pull flow

Adds initial support for provenance of official images.  Official build keys are pulled in from a static URL when an official image is requested.  If the registry version 2 is not available, the pull flow should still fallback to the version 1 registry.
I believe that this can be achieved via `APIVersion1 = iota +1` instead of the `_` field for the first one