fix(deps): update blob to v1.1.1

[jmgilman]

Summary

• Updates github.com/meigma/blob from v1.1.0 to v1.1.1
• Fixes CI failure in Publish Source Archive workflow where verify command failed with mismatch Content-Length

Root Cause

The blob library had a bug where manifest cache hits returned nil for raw bytes:

// registry/fetch.go line 102 (before fix)
if cached, ok := c.manifestCache.GetManifest(dgst); ok {
    manifest, err = parseBlobManifest(cached, dgst)
    return manifest, nil, true, err  // raw was nil!
}

This caused PolicyRequest.Subject.Size to be 0, and oras-go detected a Content-Length mismatch when the sigstore policy tried to fetch the manifest for verification.

Test plan

• CI passes (specifically the Publish Source Archive workflow verify step)
• blob verify works after blob inspect (same digest, cached manifest)

🤖 Generated with Claude Code