This PR includes a number of improvements for OCI distribution:

• HEAD requests are attempted for fetching manifest digest, with a fallback to GET (some providers to do not include the digest in the HEAD response). This appears to be preferred by registry providers such as DockerHub, because they do not apply rate limits to HEAD requests. I have confirmed that fetch_manifest_digest, including any authentication API calls, does not incur ratelimits.
• JWT tokens are now cached by (registry, repository, operation), instead of just registry. Previously, requests using the same client to perform different operations, or access different repositories in the same registry would fail, because tokens are scoped to the repository.
• Tokens are now stored in an expiring cache, which inspects the JWT for its expiration timestamp, and returns None if a token is in the cache but is expired.

Combined, these changes should make it possible to reuse the OCI client over long periods of time, with more efficient registry API usage.

Other optimizations which could be made:

• If a pull request is made, it can use a push token.
• We may want to scope tokens by auth as well, you could have a token obtained anonymously, and one obtained with auth, and they would conflict.