remove redundant intermediate images in `build --oci` flow

[preminger]

Currently, building an OCI-SIF using buildkit first builds a tar file of the OCI image, and then converts that tar to an OCI-SIF by treating it as a source for oci-archive: URI.

We should see if we can pipe the output of buildkit straight into OCI-SIF through a pipe, to avoid the creation of the intermediate tar file.

[dtrudg]

This is somewhat difficult...

To convert the OCI tar to OCI-SIF we first ensure we have the image in an OCI layout, from which it's easy to perform mutations etc.

We 'fetch' the tar file into a layout using ggcr. Within the ggcr code the tar will be opened multiple times to retrieve different files. It's not possible to work on a tar stream that cannot be re-opened from the start.

We need to directly extract the tar into the layout to bypass the tar temp file.

[dtrudg]

It's not that difficult... the buildkit tar is an OCI archive rather than a legacy Docker archive these days, so we can simply extract it and we have a layout.

[dtrudg]

It appears that after #2935 then the better approach is to keep the tarball, but read from it without extracting to a layout directory. This can be acheived by treating it as a docker-archive, rather than an oci-archive.

The buildkit tar is an OCI layout, but with the additional docker-specific manifest.json, so ggcr can read from it directly as a tarball.