policy: fixes for image source handling

- Make sure tag is added to image reference as
containerd reference parser refuses to parse otherwise.

- When attestation is asked from non-index, return
nil instead of error. This is for consistency as likely
to fail in BuildKit before that is fixed separately.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

policy/signatures.go

@@ -89,6 +89,10 @@ func parseSignatures(ctx context.Context, getVerifier PolicyVerifierProvider, ac
 	}
 	desc := toOCIDescriptor(rootBlob.Descriptor_)
 
+	if desc.MediaType != ocispecs.MediaTypeImageIndex {
+		return nil, nil
+	}
+
 	sc, err := policyimage.ResolveSignatureChain(ctx, acp, desc, platform)
 	if err != nil {
 		return nil, errors.Wrapf(err, "resolving signature chain for image %s", desc.Digest)