Allow referring images by their hashes

[AlekSi]

It should be possible to refer to images (and variants) by their SHA256 digest using the standard syntax NAME[:TAG][@DIGEST]. The correct digest, if present, should be enforced.

It also should be possible to update the digest with bldr update [--dry] if it is already present:

• if an image is specified without a digest (image: autonomy/build-container:latest), then bldr update should do nothing;
• if digest is present (image: autonomy/build-container:latest@sha256:c1a2def75622b7d1d8b4ee508720554269bdb068ba1577bd03a62a0089e9ace3), then bldr update should resolve the tag and update the digest.