GO-2026-5939: Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints in github.com/quay/claircore
NewFetcher creates a new scanner.Fetcher which downloads
layers to in memory byte arrays. if client and/or archiver is nil a default will be created.
Fetcher is safe to share concurrently.