What would you like to be added:

Without signing we need a way to identify and generate the hash for a component version.

For example, filling the componentReference digest information like:

componentReferences:
  - name: helminput
    version: 0.0.0-main
    componentName: ocm.software/plugins/helminput
    digest:
      hashAlgorithm: algo
      normalisationAlgorithm: algo
      value: value

Hash calculation is done here: https://github.com/open-component-model/ocm/blob/a1890c261fc2a5ffb58ee1590662b04a752fa9a0/api/oci/ref.go#L72

Why is this needed: