Put oras into a pipeline image that can be used by sbom diff

Background

In order to perform a diff of SBOMs, we will need to be able to pull them from the registry, which requires ORAS.

Acceptance Criteria

• oras binary added to pipeline runner image
• pipeline runner findings justified

Definition of Done

• oras commands available in pipeline runner image