Support disabling digest validation for manifestStore.Fetch in remote package

[qweeah]

Why we need this:

1. Docker-Content-Digest is not mandatory in OCI spec(see here)
2. For some registries the canonical digest header might not match the calculated digest from body if there is a media type conversion ( 'Docker-Content-Digest' header in resp won't match body digest if there is a media type conversion distribution/distribution#3718).
3. Last but not least, user should be able to trust whatever is pulled although we don't have a real user requesting that feature.

So I am starting this discussion on whether we should support disabling digest validation and also how we can possible do that without too much refactoring.

All comments are highly appreciated! 🍺