ExtractToTemp downloads srcRef, extracts its filesystem to a temp directory, and returns that path.
The caller is responsible for removing the returned directory.
Option customizes how an image is pulled. It aliases registry.Option so that pulls
and manifest checks are configured with the same registry.WithBasicAuth.