annotations: restrict character set of ref.name values

URI are standard enough. Though the most concise character set for the
URI is in the https://tools.ietf.org/html/rfc3986 unless I missed something.

Fixes #599

Signed-off-by: Vincent Batts <[email protected]>

Author: vbatts

annotations.md

@@ -25,5 +25,7 @@ This specification defines the following annotation keys, intended for but not l
 * **org.opencontainers.image.version** [Semantic versioning-compatible](http://semver.org/) version of the packaged software.
 * **org.opencontainers.image.revision** Source control revision identifier for packaged software.
 * **org.opencontainers.image.vendor** Name of the distributing entity, organization or individual.
-* **org.opencontainers.image.licenses** Comma-separated list of licenses under which contained software is distributed, in [SPDX Short identifier](https://spdx.org/licenses/) form.
-* **org.opencontainers.image.ref.name** Name of the reference for a target (string). SHOULD only be considered valid when on descriptors on `index.json` within [image layout](image-layout.md).
+* **org.opencontainers.image.licenses** Comma-separated list of licenses under which contained software is distributed, in [SPDX Short identifier]https://spdx.org/licenses/] form.
+* **org.opencontainers.image.ref.name** Name of the reference for a target (string).
+  * SHOULD only be considered valid when on descriptors on `index.json` within [image layout](image-layout.md).
+  * Character set of the value SHOULD conform to the [Uniform Resource Identifier (URI) RFC3986](https://tools.ietf.org/html/rfc3986) [`segment-nz`](https://tools.ietf.org/html/rfc3986#section-3.3).