chore(deps): update oras-project/setup-oras action to v2.0.1 (#1151)

Co-authored-by: mergeraptor[bot] <267480593+mergeraptor[bot]@users.noreply.github.com>

Author: mergeraptor[bot]

.github/workflows/build-aarch64.yml

@@ -191,7 +191,7 @@ jobs:
 
       - name: Install oras
         if: steps.push.outputs.pushed == 'true'
-        uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2.0.0
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
 
       - name: Sign image and create attestation
         # Mirrors publish.yml exactly. generate-sbom: false — dakota uses BST-native

.github/workflows/publish.yml

@@ -197,7 +197,7 @@ jobs:
           echo "digest=$(cat /tmp/digest.txt)" >> "$GITHUB_OUTPUT"
 
       - name: Install oras
-        uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2.0.0
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
 
       - name: Sign image and create attestation
         # generate-sbom: false — dakota uses just sbom (BST-native provenance via
@@ -616,7 +616,7 @@ jobs:
             --compat-auth-file ~/.docker/config.json
 
       - name: Install oras
-        uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2.0.0
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
 
       # Re-derive the image digest via skopeo so this job has no runtime
       # dependency on publish-image job outputs (avoids matrix output wiring).