Add warnings about direct use of ImageSource

[mtrmac]

Cc: @Luap99 , I’ve noticed some problematic users recently. I’ll also audit our codebases.

[mtrmac]

Switching to draft, per https://github.com/containers/buildah/pull/6014#pullrequestreview-2655024805 :

The godoc for the ImageSource type mentions that validation of things is left up to the caller, but it's not clear to me that switching to using the Unparsed... family of types and functions was how we were intended to do it. Is it that Image.Manifest() verifies the manifest's digest while caching it, but ImageSource.GetManifest() doesn't?

• Update/review the documentation at the top level ImageSource … I must have been completely blind to that already existing
• Document what UnparsedInstance guarantees.

[mtrmac]

Updated, PTAL.