Option to set the registry

[laurentsimon]

The release / deployment policy may be evaluated by

1. a registry. In this case, the policy's package name will likely only contain a package name.
2. the owner (organization) of the package. In this case the policy's package name may contain a (scheme+) registry+name (registry may be internal for certain packages and set to a public registry for public packages).

The release attestation contains the package name / URI. We need to be able to properly match the attestation field to a release and deployment policy's package name for evaluation.

This means we need an option SetPackageRegistry that registry evaluators (case (1) above) can use. For case (2), we should recommend always requiring users to set the registry.