referrer API returns 500 if a referrer manifest is deleted

[qweeah]

Description

Suppose we have a OCI artifact A, whose subject points to a manifest B. If we delete A from distribution. Referrer API /v2/<repo_name>/referrers/<tag_or_digest_of_B> will return 500 error.

Reproduce Steps

1. build oras based on oci-playground/oras

$ oras version
Version:        0.15.0+unreleased
Go version:     go1.19
Git commit:     0a87a705a0994255bd3b632a3b523a9c72b4617f
Git tree state: dirty

Follow below steps:

echo "layer" > layer.tar
echo "sbom" > sbom.tar
oras push localhost:5000/oci:artifact layer.tar
oras attach localhost:5000/oci:artifact sbom.tar
referrer_dgst=$(oras discover localhost:5000/oci:artifact -o json | jq -r .referrers[:1][].digest)
oras manifest delete localhost:5000/oci@$referrer_dgst
oras discover localhost:5000/oci:artifact # this line will fail with 500 error

The root cause is that although referrer manifest is deleted, the link in docker\registry\v2\repositories\oci\_refs\subjects still points to the deleted manifest

@FeynmanZhou Unless we fix this issue, please avoid deleting a referrer OCI artifact in the KubeCon demo.