Require metadata in commit also for OCI remotes

This was disables a long time ago because the fedora remotes didn't
contain metadata, but that has been added since then. Requiring fixes
a security concern where an app claims to require no permissions (by
having no metadata in commit) but then actually requires permissions
in the installed app.

(cherry picked from commit f0f3a35f404b5bd533186095db055f8b3d135576)