Official image provenance pull flow

Adds initial support for provenance of official images.  Official build keys are pulled in from a static URL when an official image is requested.  If the registry version 2 is not available, the pull flow should still fallback to the version 1 registry.
should be `if err := json.Unmarshal(); err != nil {` 

We always have the err and assert on the same line in all places in the codebase