Support explicitly specifying an image by SHA digest, not just tag

[baronfel]

Currently users cannot specify a ContainerBaseImage just by SHA digest. This means there is no real workaround for cases when our inference can't decipher a manifest list, or when an image doesn't provide individually-tagged OS/arch variants. We should unblock this and let users specify a digest. When a digest is specified we would skip right to blob download of the manifest json instead of pulling the tag config in order to find that same manifest. Every other part of image building should remain the same from that point onwards.