annotations: restrict character set of ref.name values

URI are standard enough, though % opens it a bit too much.
After much discussion we're going to keep it as close to the docker tag
as possible but with +, @ and /
reference: #671 (comment)

Fixes #599

Signed-off-by: Vincent Batts <vbatts@hashbangbash.com>

annotations.md

@@ -26,7 +26,10 @@ This specification defines the following annotation keys, intended for but not l
 * **org.opencontainers.image.revision** Source control revision identifier for the packaged software.
 * **org.opencontainers.image.vendor** Name of the distributing entity, organization or individual.
 * **org.opencontainers.image.licenses** Comma-separated list of licenses under which contained software is distributed, in [SPDX Short identifier](https://spdx.org/licenses/) form.
-* **org.opencontainers.image.ref.name** Name of the reference for a target (string). SHOULD only be considered valid when on descriptors on `index.json` within [image layout](image-layout.md).
+* **org.opencontainers.image.ref.name** Name of the reference for a target (string).
+  * SHOULD only be considered valid when on descriptors on `index.json` within [image layout](image-layout.md).
+  * Character set of the value SHOULD conform to alphanum of `A-Za-z0-9` and separator set of `-._:@/+`
+  * Recommended regular expression of `/[A-Za-z0-9]+[-._:@/+A-Za-z0-9]*[A-Za-z0-9]+/`
 * **org.opencontainers.image.name** Human-readable name of the software packaged in the image (string)
 * **org.opencontainers.image.description** Human-readable description of the software packaged in the image (string)