Official image provenance pull flow

Adds initial support for provenance of official images.  Official build keys are pulled in from a static URL when an official image is requested.  If the registry version 2 is not available, the pull flow should still fallback to the version 1 registry.
@dmcgowan can you add a small comment, why `3` ?