annotations: restrict character set of ref.name values

URI are standard enough, though % opens it a bit too much.
After much discussion we're going to keep it as close to the docker tag
as possible but with +, @ and /
reference: opencontainers#671 (comment)

Fixes opencontainers#599

Signed-off-by: Vincent Batts <vbatts@hashbangbash.com>

annotations.md

@@ -28,7 +28,10 @@ This specification defines the following annotation keys, intended for but not l
 * **org.opencontainers.image.revision** Source control revision identifier for the packaged software.
 * **org.opencontainers.image.vendor** Name of the distributing entity, organization or individual.
 * **org.opencontainers.image.licenses** License(s) under which contained software is distributed as a [SPDX License Expression][spdx-license-expression].
-* **org.opencontainers.image.ref.name** Name of the reference for a target (string). SHOULD only be considered valid when on descriptors on `index.json` within [image layout](image-layout.md).
+* **org.opencontainers.image.ref.name** Name of the reference for a target (string).
+  * SHOULD only be considered valid when on descriptors on `index.json` within [image layout](image-layout.md).
+  * Character set of the value SHOULD conform to alphanum of `A-Za-z0-9` and separator set of `-._:@/+`
+  * Recommended regular expression of `/[A-Za-z0-9]+[-._:@/+A-Za-z0-9]*[A-Za-z0-9]+/`
 * **org.opencontainers.image.title** Human-readable title of the image (string)
 * **org.opencontainers.image.description** Human-readable description of the software packaged in the image (string)