Adding the ability to patch IndexReports would allow us to support a grip of "external-indexing" workflows and a plugin workflow.

For example, we could write a tool that integrates with quay's S3 schema to "pre-index" layers when the indexer changes, thus making the quay security worker's submission API a indexing no-op to which just updates the metadata.