FR: support multiple image locations in oci_pull

[apesternikov]

We are mirroring base images to local registry in order to improve availability. Unfortunately this either requires setting up of something like a transparent proxy registry or some kind of additional steps to be done before image is available in a bazel build. To streamline the mirroring use case, It would be very useful to support multiple image locations, mimicking the "url-urls" pattern used in http_* rules Example:

oci_pull(
    name = "distroless_java",
    digest = "sha256:161a1d97d592b3f1919801578c3a47c8e932071168a96267698f4b669c24c76d",
    images = [
        "local.registry/mirror/distroless/java17",
        "gcr.io/distroless/java17"
    ],
    platforms = ["linux/amd64"],  # Optional
)

Implementation should try to fetch images in provided order until one succeeds, failing only if all of them fails. It should be an error if different digests are specified. It is not clear if this should be also extended to repository and registry parameters.

[thesayyn]

This is an interesting idea, we'd have to bikeshed an api for this though as it makes the public api more complex.