Bound remote config blob reads

[Haihan-Jiang]

Summary

• add a bounded read helper that reads max+1 bytes and returns a clear error when a response exceeds the limit
• cap remote image config blobs at 100 MiB before fetching and while reading
• add tests for the limit helper and for rejecting an oversized config descriptor before issuing a blob request

Fixes #2204 for current main; the other issue-listed remote error, auth token, and referrers reads are already bounded there.

Testing

• go test ./pkg/v1/remote
• go test ./pkg/v1/remote/transport
• git diff --check
• ./hack/presubmit.sh (package tests passed, then local script failed because registry was not found on PATH for cmd/crane/rebase_test.sh; this left no source changes)

[Haihan-Jiang]

This is ready for review. The remote config blob read is now bounded, and the visible checks are green.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 80.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 56.93%. Comparing base (31df54c) to head (1bcb8fe).
⚠️ Report is 19 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/v1/remote/fetcher.go	71.42%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2324      +/-   ##
==========================================
+ Coverage   56.91%   56.93%   +0.01%     
==========================================
  Files         165      165              
  Lines       11362    11371       +9     
==========================================
+ Hits         6467     6474       +7     
- Misses       4134     4135       +1     
- Partials      761      762       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.