doc/plans: Update OCI sealing spec (kernel sigs, flattened layers)

Two big goals:

- Support for kernel-native fsverity signatures to be associated with a digest
- Generalize the "flattened vs per-layer digest"; any layer can now
  have either.

Signed-off-by: Colin Walters <walters@verbum.org>

Author: cgwalters