[v0.32 backport] exporter: fix attestation manifest push order - #7013

OCI artifact attestations carry a subject reference to the image manifest.
Push manifests in an order that keeps child manifests before parent indexes
while also pushing any in-stack subject manifest before the attestation
that references it.

Add an integration test variant with a strict registry proxy to cover
registries that reject manifests whose subject doesn't already exist.

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
(cherry picked from commit 067b18b)