make call cache sensitive to docker image content

[mlin]

As a reproducibility best practice, task runtime section should encode the precise version of the docker image required, instead of relying on a mutable tag like latest. However this is not convenient for a developer simultaneously iterating on their WDL and docker image.

Call cache should record the content digest of the image actually used to execute a task, and later on a lookup attempt, see if the tag still refers to the same digest or not. Gnarly detail: in a distributed setting, it's possible that the head and worker nodes may currently have different images cached for the same tag.