Support directly comparing Docker/OCI tar balls without `diffoci load`

An OCI tar ball may contain multiple images. Maybe only the first one should be used (with a warning)

https://github.com/opencontainers/image-spec/blob/v1.0.2/media-types.md#relations