Manifest: Support to manifest annotate "annotations"

[ChengyuZhu6]

Currently, nerdctl manifest annotate only supports annotating the manifest’s platform fields. e.g.:

# nerdctl manifest inspect ubuntu:20.04
{
    "schemaVersion": 2,
    "mediaType": "application/vnd.oci.image.index.v1+json",
    "manifests": [
        {
            "mediaType": "application/vnd.oci.image.manifest.v1+json",
            "digest": "sha256:c664f8f86ed5a386b0a340d981b8f81714e21a8b9c73f658c4bea56aa179d54a",
            "size": 424,
            "annotations": {
                "com.docker.official-images.bashbrew.arch": "amd64",
                "org.opencontainers.image.base.name": "scratch",
                "org.opencontainers.image.created": "2025-04-04T00:00:00Z",
                "org.opencontainers.image.revision": "fb4da0956290c3b216a35315510f66ca9bc4a460",
                "org.opencontainers.image.source": "https://git.launchpad.net/cloud-images/+oci/ubuntu-base",
                "org.opencontainers.image.url": "https://hub.docker.com/_/ubuntu",
                "org.opencontainers.image.version": "20.04"
            },
            "platform": {
                "architecture": "amd64",
                "os": "linux"
            }
        }
    ]
}

However, it cannot annotate the annotations of an image manifest. This limitation affects containerd checkpoint/restore feature that need to add CRIU-related annotations:

{
    "schemaVersion": 2,
    "mediaType": "application/vnd.oci.image.manifest.v1+json",
    "config": {
        "mediaType": "application/vnd.oci.image.config.v1+json",
        "digest": "sha256:e58e8cd88079c01bb6ee382d2e1fb21f7032a2486bb701d5aaabfcec385fb14f",
        "size": 343
    },
    "layers": [
        {
            "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
            "digest": "sha256:04a2caa8c7551b96615111d1f3c6f8a3b00d986e65acfef437bb83cfafb9ed32",
            "size": 44627
        }
    ],
    "annotations": {
        "org.criu.checkpoint.container.name": "test",
        "org.opencontainers.image.base.digest": "",
        "org.opencontainers.image.base.name": ""
    }
}

Let's extend nerdctl manifest annotate to support setting annotations, which would enable container checkpoint/restore scenarios requiring CRIU annotations.

[ChengyuZhu6]

cc @AkihiroSuda