add wasm runtimes (embedded and nodejs) in kpt

[mengqiy]

This PR introduces 2 commands: kpt alpha wasm push and kpt alpha wasm pull:

• kpt alpha wasm push [path-to-local-wasm-file] [desired-OCI-image-name]
• kpt alpha wasm pull [OCI-image-name] [desired-local-path-to-store-the-wasm-file]

This PR added 2 wasm runtimes (one embedded wasmtime and node.js) in kpt:

• It is not a WASI runtime, since golang doesn't have a great support to compile go program to WASI and most of our KRM functions are written in go.
• It requires the wasm to register a js function called processResourceList in the globals.

To use it in Kptfile:

apiVersion: kpt.dev/v1
kind: Kptfile
metadata:
  name: app
pipeline:
  mutators:
    - wasm: gcr.io/kpt-fn-demo/set-namespace:v0.5.0 # Note: this image has a manifest with arch: wasm and os: js
      configMap:
        namespace: staging
    - wasm: gcr.io/kpt-fn-demo/set-labels:v0.2.0 # Note: this image has a manifest with arch: wasm and os: js
      configMap:
        foo: bar

Then run kpt fn render --allow-alpha-wasm with 2 functions. KPT_FN_WASM_RUNTIME can be used to select a runtime.

Syntax	embedded wasmtime	node.js	container
first run	real 0m8.648s user 0m44.559s sys 0m1.047s	TODO	TODO
subsequent run	real 0m1.223s user 0m1.125s sys 0m0.498s	TODO	TODO

This PR requires CGO, it seems cross compilation doesn't work nicely with CGO. We are using GitHub actions to ensure it can be compiled on other OS. #3463 blocks it from working on windows.

To produce wasm artifacts, please take a look at GoogleContainerTools/kpt-functions-catalog#898.

Depends on #3470

[justinsb]

Some small nits, but this is pretty close I think.

I think sending the go 1.19 and ioutil -> os changes separately would help make this much more reviewable.

[mengqiy]

I think sending the go 1.19 and ioutil -> os changes separately would help make this much more reviewable.

These changes are really from #3447. I cherry picked the commits to make CI happy.

This PR requires CGO, but it seems we cross compilation doesn't work nicely with CGO. To workaround it, We may need to build it in container for darwin and windows. @justinsb Any suggestions or prior arts in other k8s projects?

[mengqiy]

I just realized that a few comments have not been addressed. I missed them until I resolved other comments. I will resolve them tomorrow.
Meanwhile the PR is mostly ready for another round of review.

I have move part of porch/pkg/oci package to pkg/oci. If you think I should split it out to its own PR. Please let me know. It should not be hard to do it.

[natasha41575]

lgtm, defer to @justinsb for final approval

[justinsb]

Two small things, but lgtm!