Create copy of buffer for SignedManifest.Raw

Without this copy, the buffer may be re-used in the json package, causing
missing or corrupted content for the long-lived SignedManifest object. By
creating a new buffer, owned by the SignedManifest object, the content remains
stable.

storage/manifest.go

@@ -174,7 +174,8 @@ func (sm *SignedManifest) UnmarshalJSON(b []byte) error {
 	}
 
 	sm.Manifest = manifest
-	sm.Raw = b
+	sm.Raw = make([]byte, len(b), len(b))
+	copy(sm.Raw, b)
 
 	return nil
 }