fix(xray): Add gzip decompression for OCI image layers

[Technophobe01]

Problem

When running xray on Docker images with gzip-compressed layers (which is the default for most Docker Hub images), the command fails with errors like:

error="archive/tar: invalid tar header"

or

error="unexpected EOF"

This happens because LoadPackage in pkg/docker/dockerimage/dockerimage.go tries to read gzip-compressed layer blobs directly as tar archives without decompressing them first.

Root Cause

OCI/Docker images typically use gzip-compressed layers with media types like:

• application/vnd.docker.image.rootfs.diff.tar.gzip
• application/vnd.oci.image.layer.v1.tar+gzip

The existing code at line ~1133 passes the raw stream to tar.NewReader():

layer, err := layerFromStream(
    pkg,
    hdr.Name,
    tar.NewReader(tr),  // <- reads gzip data as tar, fails
    ...
)

There's also a TODO comment at line 926 acknowledging this:

// todo: add support for oci.MediaTypeImageLayerGzip and oci.MediaTypeImageLayerZstd

Solution

This PR adds gzip decompression support by:

1. Checking the OCI manifest media type stored in nonLayerFileNames for gzip indication
2. Attempting gzip decompression using gzip.NewReader() which validates the gzip magic header
3. Falling back to raw tar reading if the data is not gzip-compressed
4. Properly reporting errors when media type indicates gzip but decompression fails

Testing

Tested with various Docker Hub images that use gzip-compressed layers:

• autonomousplane/chatgpt-clone:latest (Python)
• autonomousplane/carbon.now.sh:latest (Node.js)
• Standard alpine, node, python images

Before fix: archive/tar: invalid tar header error
After fix: xray completes successfully with state=done

Checklist

• Code compiles without errors
• Follows existing code style
• Includes DCO sign-off
• Backwards compatible (non-gzip layers still work)