ORAS tooling should be kept up to date

[NikolaMilosavljevic]

#1311 has added ORAS tooling to Image Builder's image, with a static version defined in Dockerfile.

We should have a plan to keep this version up to date.

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[lbussell]

[Triage] One option for keeping ORAS up-to-date would be to adopt the ORAS .NET library and then use a tool like Dependabot to keep it updated.