erofs-differ: fix filesystem UUID for tar-converted layers

Derive filesystem UUIDs (`lsblk -o +UUID`) from the OCI layer digests
(although diffIDs are better in principle, but they're unavailable by
differs in advance) rather than generating a random one.  This allows
EROFS to uniquely identify each layer using the content-addressable
filesystem UUID.

It can also be used for reproducible builds. To achieve this, configure
`mkfs_options` with `-T0 --mkfs-time` (However, `--mkfs-time` requires
erofs-utils 1.8+; Otherwise, all inode timestamps will be reset w/o it):

``` toml
  [plugins."io.containerd.differ.v1.erofs"]
    mkfs_options = ["-T0 --mkfs-time"]
```

Fixes: c73c8e5d52 ("Introduce EROFS differ")
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>

plugins/diff/erofs/differ_linux.go

@@ -43,6 +43,8 @@ import (
 	"github.com/containerd/containerd/v2/pkg/archive/compression"
 	"github.com/containerd/containerd/v2/pkg/epoch"
 	"github.com/containerd/containerd/v2/pkg/labels"
+
+	"github.com/google/uuid"
 )
 
 var emptyDesc = ocispec.Descriptor{}
@@ -299,7 +301,8 @@ func (s erofsDiff) Apply(ctx context.Context, desc ocispec.Descriptor, mounts []
 		r: io.TeeReader(processor, digester.Hash()),
 	}
 
-	err = erofsutils.ConvertTarErofs(ctx, rc, layerBlobPath, s.mkfsExtraOpts)
+	u := uuid.NewSHA1(uuid.NameSpaceURL, []byte("erofs:blobs/"+desc.Digest))
+	err = erofsutils.ConvertTarErofs(ctx, rc, layerBlobPath, u.String(), s.mkfsExtraOpts)
 	if err != nil {
 		return emptyDesc, fmt.Errorf("failed to convert erofs: %w", err)
 	}