Add support for signing non-local targets

[mnm678]

Add the ability for Targets metadata to sign a target without needing to load the local target file. To do so, the repository could take the digest, length, and any custom metadata and create the Targets metadata for this information without needing to read a file from disk.

This would allow Targets metadata to sign OCI artifacts using the digest and size provided by registry APIs.

[trishankatdatadog]

Right. I'm sure a simple function (if it isn't already there) should quickly resolve this.