test: pin images to manifest digest

[crazy-max]

tests fail since last month: https://github.com/tonistiigi/binfmt/actions/runs/11813052701/job/32909713187#step:6:76

Unable to find image 'arm64v8/alpine:latest' locally
latest: Pulling from arm64v8/alpine
docker: no matching manifest for linux/amd64 in the manifest list entries.
See 'docker run --help'.

But was working the week before first failure: https://github.com/tonistiigi/binfmt/actions/runs/11626308529/job/32377744558#step:6:74

Unable to find image 'arm64v8/alpine:latest' locally
latest: Pulling from arm64v8/alpine
cf04c63912e1: Pulling fs layer
cf04c63912e1: Verifying Checksum
cf04c63912e1: Download complete
cf04c63912e1: Pull complete
Digest: sha256:9cee2b382fe2412cd77d5d437d15a93da8de373813621f2e4d406e3df0cf0e7c
Status: Downloaded newer image for arm64v8/alpine:latest
WARNING: The requested image's platform (linux/arm64/v8) does not match the detected host platform (linux/amd64/v3) and no specific platform was requested
Linux 2f0d98978cdf 6.5.0-1025-azure #26~22.04.1-Ubuntu SMP Thu Jul 11 22:33:04 UTC 2024 aarch64 Linux

After discussion with @thaJeztah, it looks like image format has changes recently. Before it was a single manifest:

$ docker buildx imagetools inspect arm64v8/alpine@sha256:9cee2b382fe2412cd77d5d437d15a93da8de373813621f2e4d406e3df0cf0e7c
Name:      docker.io/arm64v8/alpine@sha256:9cee2b382fe2412cd77d5d437d15a93da8de373813621f2e4d406e3df0cf0e7c
MediaType: application/vnd.docker.distribution.manifest.v2+json
Digest:    sha256:9cee2b382fe2412cd77d5d437d15a93da8de373813621f2e4d406e3df0cf0e7c

Now it is an OCI index:

$ docker buildx imagetools inspect arm64v8/alpine:latest
Name:      docker.io/arm64v8/alpine:latest
MediaType: application/vnd.oci.image.index.v1+json
Digest:    sha256:7d206216871a9feecd6c6689d895889577fdcb28f3f789d8243b3a12f38a2730

Manifests:
  Name:        docker.io/arm64v8/alpine:latest@sha256:ea3c5a9671f7b3f7eb47eab06f73bc6591df978b0d5955689a9e6f943aa368c0
  MediaType:   application/vnd.oci.image.manifest.v1+json
  Platform:    linux/arm64/v8
  Annotations:
    org.opencontainers.image.version:         3.20.3
    com.docker.official-images.bashbrew.arch: arm64v8
    org.opencontainers.image.base.name:       scratch
    org.opencontainers.image.created:         2024-11-12T00:54:34Z
    org.opencontainers.image.revision:        7d63673353bd39d92ba42f6effcc199aeebd45ee
    org.opencontainers.image.source:          https://github.com/alpinelinux/docker-alpine.git#7d63673353bd39d92ba42f6effcc199aeebd45ee:aarch64
    org.opencontainers.image.url:             https://hub.docker.com/_/alpine

  Name:        docker.io/arm64v8/alpine:latest@sha256:a8ba68c1a9e6eea8041b4b8f996c235163440808b9654a865976fdcbede0f433
  MediaType:   application/vnd.oci.image.manifest.v1+json
  Platform:    unknown/unknown
  Annotations:
    vnd.docker.reference.type:                attestation-manifest
    com.docker.official-images.bashbrew.arch: arm64v8
    vnd.docker.reference.digest:              sha256:ea3c5a9671f7b3f7eb47eab06f73bc6591df978b0d5955689a9e6f943aa368c0

And therefore docker doesn't allow non-matching platform because this is a multi-platform image.