spec: namespace image-spec labels with "org.opencontainers.image"

[stevvooe]

When labels from images land elsewhere through propagation, it is hard to tell their source. Let's add .image to annotation prefix to make it clear when a label is part of an image.

Please see #492 (comment) for the original issue.

cc @cyphar @vbatts

[cyphar]

👍

[vbatts]

i like the provenance, though does this include the reference to that image's manifest digest as well?

[jonboulle]

@vbatts hmm, you mean so one can reverse-trace from a runtime-spec config.json to an image?

[vbatts]

@jonboulle maybe that too, but not what i was originally thinking. More like "i have ubuntu LTS image (sha256:deadbeefface..), and add my software on top" as only the ubuntu LTS layers stay referenced, but not the original manifest. This would allow a pointer to those objects.

[stevvooe]

@vbatts This was not intended to go that far. I placed a comment in #424 clarifying the possible link.

I'll create a PR for this one today.

[vbatts]

oh oh. this is just an addition onto the prefix, not an .image name. sorry