Add OCI source annotation to updater core image

[mctofu]

This will help Dependabot include relevant change details when it opens PRs against this image. Support was added in #6864.

I'm not sure if we also need to add this label to each ecosystem image. I'll followup with that change if this doesn't have the expected result.

[Nishnha]

❤️

[mctofu]

Confirmed this label is present in the ecosystem images:

% regctl image inspect ghcr.io/dependabot/dependabot-updater-bundler:9b526b7214f5b03a6d9378efb03b1cc55d258762 | jq .config
{
  "User": "dependabot",
  "Env": [
    "PATH=/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
    "DEBIAN_FRONTEND=noninteractive",
    "LC_ALL=en_US.UTF-8",
    "LANG=en_US.UTF-8",
    "GIT_LFS_SKIP_SMUDGE=1",
    "DEPENDABOT_HOME=/home/dependabot",
    "DEPENDABOT_NATIVE_HELPERS_PATH=/opt"
  ],
  "Cmd": [
    "bin/run"
  ],
  "WorkingDir": "/home/dependabot/dependabot-updater",
  "Labels": {
    "org.opencontainers.image.ref.name": "ubuntu",
    "org.opencontainers.image.source": "https://github.com/dependabot/dependabot-core",
    "org.opencontainers.image.version": "20.04"
  },
  "ArgsEscaped": true
}

Labels are also inherited from our base ubuntu image. That means if maintainers don't set the source annotation in their own image Dependabot can pick up the change logs from a base image instead which may not be desired behavior.