OCI artifact pushes can trigger HTTP GET requests to remote locations

[mtrmac]

From #26111 (comment):

But, curiously enough, oci/layout.GetBlob can trigger a HTTP request if the manifest contains alternative URLs. …

I guess c/image should provide an opt-out of oci/layout causing network traffic? We could also switch the order to check local files first; that would, pedantically, be an API break.

[github-actions]

A friendly reminder that this issue had no activity for 30 days.