fix: bump oras-go to the latest commit which fixes the symlink issue

[Wwwsylvia]

What this PR does / why we need it:

Bump the oras-go dependency to the latest commit cb6d75be7dd4a78f25fe9d00c76c0d15c4296da6 which includes the bug fix for oras-project/oras-go#865.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #1593

Please check the following list:

• Does the affected code have corresponding tests, e.g. unit test, E2E test?
• Does this change require a documentation update?
• Does this introduce breaking changes that would require an announcement or bumping the major version?
• Do all new files have an appropriate license header?

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 84.31%. Comparing base (128d10a) to head (5204ab4).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1628   +/-   ##
=======================================
  Coverage   84.31%   84.31%           
=======================================
  Files         121      121           
  Lines        5566     5566           
=======================================
  Hits         4693     4693           
  Misses        619      619           
  Partials      254      254           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[Wwwsylvia]

Before:

After:

[shizhMSFT]

LGTM