Create copy of buffer for SignedManifest.Raw

Without this copy, the buffer may be re-used in the json package, causing
missing or corrupted content for the long-lived SignedManifest object. By
creating a new buffer, owned by the SignedManifest object, the content remains
stable.
Use json.MashalIndent for raw manifest json

This provides compatibility with what is in docker core, ensuring that image
manifests generated here have the same formatting. We'll need to automate this
some how.
Cleanup image verification error handling

This diff removes a few early outs that caused errors to be unreported and
catches a missed error case for signature verification from libtrust. More work
needs to be done around ensuring consistent error handling but this is enough
to make the API work correctly.
Avoid manifest verification errors by using Raw

Because json.Marshal does compaction on returned results, applications must
directly use SignedManifest.Raw when the marshaled value is required.
Otherwise, the returned manifest will fail signature checks.
Add TODO about manifest tampering test
Merge pull request #805 from stevvooe/ng-manifest-bugs

NG: Various Manifest Oriented bugfixes