Vote for release of v2.4.0

[Wwwsylvia]

At least 3 approvals are needed from the 4 owners for tagging 850a247 as v2.4.0.

• Sajay Antony (@sajayantony)
• Shiwei Zhang (@shizhMSFT)
• Steve Lasker (@SteveLasker)
• Sylvia Lei (@Wwwsylvia)

See the v2.4.0 milestone and the change log for more details.
Please respond LGTM or REJECT (with reasoning).

---

Detailed commits compared to v2.3.1:

• Add SECURITY.md file #579
• build(deps): bump actions/checkout from 3 to 4 #585
• build: bump go version #587
• feat: merge package credentials back from oras-credentials-go #589
• fix: push an empty index when deleting the last referrer with SkipReferrersGC #593
• feat: Add 'MemoryStore' #602
• refactor: make credentials.NewMemoryStore return an interface #605
• fix: Avoid a copy of sync.Mutex in Repository #603
• fix: correctly handle OnCopySkipped #609
• feat: support per-host scope hints #604
• feat: support deletion for memory resolver #607
• feat: support deletion for OCI storage #608
• build(deps): bump golang.org/x/sync from 0.3.0 to 0.4.0 #611
• build: bump github.com/opencontainers/image-spec to v1.1.0-rc5 #615
• fix: package credentials to support legacy auth keys in docker config #617
• feat: support deletion for memory graph #606
• perf: reduce auth request count for manifest delete #618
• fix: error handling when delete non-existent target #627
• chore: add reference details to errors #628
• feat: minimal change to support cross-repo blob mounting #631
• build(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 #637
• feat: extend oci.Store with Delete() #614
• fix: rename ErrSkipDesc to SkipNode #643
• fix: check content-type when using referrers API #635
• build(deps): bump actions/setup-go from 4 to 5 #655
• build(deps): bump github/codeql-action from 2 to 3 #658
• feat: add Untag() to *oci.Store #647
• feat: Referrers support for content.ReadOnlyGraphStorage #659
• feat: GC on oci.Store.Delete #653
• feat: add a host-based auth cache as a fallback #651
• build: increase code coverage threshold to 75% #666
• build(deps): bump golang.org/x/sync from 0.5.0 to 0.6.0 #669
• feat: add MountFrom and OnMounted to CopyGraphOptions #665
• docs: add example to parse reference with digest #675
• feat: Public GC function of oci.Store #656
• feat: error type for not finding basic auth creds and export config path #674
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc5 to 1.1.0-rc.6 #681
• build(deps): use image-spec v1.1.0-rc6 instead of rc.6 #687
• feat: allow skip unpack on push to file store #679
• feat: mark untagged manifests as garbage during GC and delete #680
• refactor: upgrade to distribution-spec v1.1.0-rc4 #690
• fix: fix the potential panic error if there is no platform in the index or manifest list #695
• refactor: remove AutoRemoveReferrers flag #683

[shizhMSFT]

LGTM. We should call out

• The credentials package is moved from oras-credentials-go to oras-go.
• We need a Performance Improvement section in the release note 😃
• oras-go is with the latest OCI spec!

[sajayantony]

LGTM.

[Wwwsylvia]

Closing as v2.4.0 has been released.