Produce a manifest with a non-zero config

[cbandy]

I could not copy trivy-checks into Harbor today because Harbor does not understand a "size":0 manifest config.

The OCI image spec calls out this case and recommends sending an empty JSON object instead: https:/opencontainers/image-spec/blob/v1.1.0/manifest.md#guidance-for-an-empty-descriptor

ORAS knows what to do with these things, so this change uses it the same way as trivy-db: https:/aquasecurity/trivy-db/blob/32c63a9af03ffd449a6ffb4471745b6ec9714875/.github/workflows/cron.yml#L73

            ./oras push --artifact-type application/vnd.aquasec.trivy.config.v1+json \

Here's a discussion about the OPA bundle format showing similar: open-policy-agent/opa#1413 (comment)

  "config": {
    "mediaType": "application/vnd.cncf.openpolicyagent.config.v1+json",
    "digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
    "size": 2
  },

[CLAassistant]

All committers have signed the CLA.

[simar7]

@cbandy thanks for the catch, it lgtm!

[simar7]

One small note, we can also add this to our testing here:

trivy-checks/scripts/verify-bundle.go

Line 17 in e0baac7

var OrasPush = []string{"--config", "/dev/null:application/vnd.cncf.openpolicyagent.config.v1+json", fmt.Sprintf("%s:application/vnd.cncf.openpolicyagent.layer.v1.tar+gzip", bundlePath)}

[cbandy]

Thank you for the quick response! Amended and rebased.

📝 I was not able to run that test locally.

[cbandy]

For reference, here's the issue I opened with Harbor: goharbor/harbor#21018