support accessory in either order

[wy65701436]

In certain cases, the OCI client may push the subject artifact and accessory in either order. Therefore, it is necessary to handle situations where the client pushes the accessory ahead of the subject artifact.

Thank you for contributing to Harbor!

Comprehensive Summary of your change

Issue being fixed

Fixes #19345

Please indicate you've done the following:

• Well Written Title and Summary of the PR
• Label the PR as needed. "release-note/ignore-for-release, release-note/new-feature, release-note/update, release-note/enhancement, release-note/community, release-note/breaking-change, release-note/docs, release-note/infra, release-note/deprecation"
• Accepted the DCO. Commits without the DCO will delay acceptance.
• Made sure tests are passing and test coverage is added if needed.
• Considered the docs impact and opened a new docs issue or PR with docs changes if needed in website repository.

[codecov]

Codecov Report

Merging #19375 (4d3c72f) into main (6fd4a2b) will decrease coverage by 0.04%.
The diff coverage is 50.00%.

@@            Coverage Diff             @@
##             main   #19375      +/-   ##
==========================================
- Coverage   67.46%   67.43%   -0.04%     
==========================================
  Files         988      988              
  Lines      108688   108732      +44     
  Branches     2752     2752              
==========================================
- Hits        73328    73324       -4     
- Misses      31420    31463      +43     
- Partials     3940     3945       +5     

Flag	Coverage Δ
unittests	67.43% <50.00%> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files Changed	Coverage Δ
src/pkg/accessory/dao/dao.go	61.44% <33.33%> (-4.76%)	⬇️
src/server/middleware/subject/subject.go	48.48% <46.15%> (-0.84%)	⬇️
src/pkg/accessory/manager.go	83.69% <100.00%> (+1.13%)	⬆️

... and 10 files with indirect coverage changes

[chlins]

lgtm

[MinerYang]

lgtm