lib: Update to oci-spec 0.7

[cgwalters]

There are a few semver breaks there, but I helped drive them because they clean up the codebase here.

Most notably:

• We have hardened upstream "verify descriptor is sha256:" logic
• size is now properly u64

etc.