[dependabot]: Bump OrasProject.Oras from 0.5.0 to 0.7.0

[dependabot]

Updated OrasProject.Oras from 0.5.0 to 0.7.0.

Release notes

Sourced from OrasProject.Oras's releases.

0.7.0

The NuGet package is available at nuget.org.

[!IMPORTANT]
This release includes API and behavioral breaking changes in authentication. The auth
challenge type was refactored (Challenge.Scheme → top-level ChallengeScheme, and
ParseChallenge → Parse / TryParse), custom ICache implementations must be updated, and
stale cached-token challenge recovery is now part of the default auth flow. Please read the
Breaking Changes and Migration Guide sections before upgrading.

Breaking Changes

• The nested Challenge.Scheme enum is now the top-level ChallengeScheme (#​415). The
  Basic / Bearer / Unknown values moved from Challenge.Scheme to a new top-level
  public enum ChallengeScheme in OrasProject.Oras.Registry.Remote.Auth. Replace every
  Challenge.Scheme reference with ChallengeScheme (e.g. Challenge.Scheme.Bearer →
  ChallengeScheme.Bearer).
• Challenge is now a readonly record struct, and ParseChallenge is replaced by Parse / TryParse (#​415).
  Challenge changed from a static helper class to a readonly record struct carrying
  ChallengeScheme Scheme and IReadOnlyDictionary<string, string>? Parameters. The
  ParseChallenge(string?) method that returned a (Scheme, Dictionary<string, string>?) tuple was
  removed. Use Challenge.Parse(header) (throws FormatException on a malformed challenge) or
  Challenge.TryParse(header, out var challenge) (non-throwing).
• ICache implementations must switch to ChallengeScheme (#​415). ICache.TryGetScheme,
  ICache.SetCache, and ICache.TryGetToken now take (or emit) ChallengeScheme instead of
  Challenge.Scheme. Any custom ICache implementation must update these signatures to compile.
• Malformed-challenge parsing no longer throws, and duplicate parameters no longer fail (#​415).
  An unterminated quoted parameter value now makes Challenge.TryParse return false (instead of
  throwing), and a repeated parameter key keeps its last value instead of throwing. Challenge.Parse
  still throws FormatException for a malformed challenge.
• Stale cached-token challenge recovery is now built into the default auth flow (#​415). See
  Bug Fixes below. This only changes behavior when a request carried an SDK-cached bearer token
  and standard challenge handling dead-ends; conformant registries are unaffected, and a caller that
  sets its own Authorization header opts out of recovery.

Migration Guide (v0.6.0 → v0.7.0)

1. Replace Challenge.Scheme with ChallengeScheme — the enum is now top-level:

   // before
   if (scheme == Challenge.Scheme.Bearer) { /* ... */ }
   
   // after
   if (scheme == ChallengeScheme.Bearer) { /* ... */ }

2. Update custom ICache implementations to the new enum type on all three members:

   // before

... (truncated)

0.6.0

The NuGet package is available at nuget.org.

[!IMPORTANT]
This release includes behavioral breaking changes in authentication and OCI manifest
serialization that are not obvious from method signatures. Please read the Breaking Changes
and Migration Guide sections before upgrading.

Breaking Changes

• Auth realm validation is now enabled by default and is least-permissive (#​393, #​403). A
  freshly constructed auth Client now validates the bearer-challenge realm and, by default, only
  allows realms on the same host as the registry (HTTPS; scheme-default or matching port; no
  built-in trusted hosts). Registries whose token realm lives on a different host (e.g. Docker Hub:
  registry-1.docker.io → auth.docker.io) now require explicit opt-in:

  new Client(httpClient)
  {
      RealmValidator = new DefaultRealmValidator
      {
          TrustedRealmHosts = ImmutableHashSet.Create("auth.docker.io")
      }
  };

• ScopeManager scope state is now partitioned by partitionId (#​404). Six public methods
  (GetScopesForHost, GetScopesStringForHost, both SetActionsForRepository overloads, and both
  SetScopeForRegistry overloads) gained a required string? partitionId parameter. Pass null
  to preserve the previous unpartitioned behavior.
• OCI manifests now use Go-compatible JSON encoding (#​348). Serialized manifest bytes are now
  byte-for-byte compatible with oras-go / Go encoding/json (+ is no longer escaped; <, >,
  &, U+2028 and U+2029 are escaped as Go does). This changes the digest of any manifest whose
  fields contain those characters — recompute or re-push any digests cached from earlier versions.
• Manifest serialization now enforces a 4 MiB limit (#​348). Packing a manifest that serializes
  to more than 4 MiB now throws SizeLimitExceededException.
• Stricter auth scope parsing (#​396, #​404). Scope.TryParse now rejects malformed scope
  strings that were previously accepted (empty resource type/name/action segments).

Migration Guide (v0.5.0 → v0.6.0)

1. Update ScopeManager calls — the six methods now take a partitionId. Pass null for the
   previous behavior (or a non-null id to isolate scope state per tenant/identity):

   // before
   scopeManager.SetActionsForRepository(reference, Scope.Action.Pull);
   var scopes = scopeManager.GetScopesForHost("registry.example.com");
   // after
   scopeManager.SetActionsForRepository(reference, partitionId: null, Scope.Action.Pull);
   var scopes = scopeManager.GetScopesForHost("registry.example.com", partitionId: null);

2. Opt into cross-host auth realms — if a registry's token realm is on a different host from the
   registry (Docker Hub, GitLab, NVIDIA NGC, …), add the realm host to TrustedRealmHosts or supply
   ... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)