Summary
Last iteration we investigated the use of the referral API for linking chart/app metadata to Helm charts in an OCI repository (using Harbor), together with a rough implementation (for public OCI repos only) demonstrating how that data can be fetched for display within the application details.

To turn that demo into landable code, we'll need to support private OCI repositories, test the code to avoid future regressions, improve the UX (see below) and enable downloading of the displayed metadata.

Acceptance criteria

• Example code for attaching metadata images to charts, with the recommended annotations for human readability,
• Implementation of the gRPC request for getting metadatas for a chart, from both a public or private OCI repository, with relevant tests,

Then, given items of metadata in the OCI repository that refer to the main chart in a public or private OCI repository, when displaying the application details in Kubeapps, we will show:

• A human readable title for the metadata (eg. "Source-code Bill of Materials") when the standard "org.opencontainers.image.title" annotation is defined (see pre-defined-annotation-keys), defaulting to the less-friendly media type when the annotation is not defined.
• Further details such as the sha and any "org.opencontainers.image.description" if populated (possibly in a tool-tip given the limited space available)
• A clickable link that will begin downloading the metadata, proxied via the Kubeapps backend with the users' credentials so they can inspect the metadata locally (we may need to limit the size of the metadata for this, as we don't want to tie-up our apis service streaming binary data, but need to proxy it from the backend where we have access to user credentials).