Official image provenance pull flow

Adds initial support for provenance of official images.  Official build keys are pulled in from a static URL when an official image is requested.  If the registry version 2 is not available, the pull flow should still fallback to the version 1 registry.
I think you should have unit tests for these areas of the code.  As it appears that this section of the code bases is going under active development small checks like this should be tested to make sure that we don't have any regressions later on.  We know that testing the push/pull code is hard without mocking out external resources but these types of sections of the code can be factored out into a function and tested easily.