Add digest pinning for Docker images

[JamieMagee]

What are you trying to accomplish?

Docker tags are mutable. If someone compromises a registry, they can swap out the image contents without changing the tag. Digests prevent this because they're content-addressed.

Right now, Dependabot only updates digests if you already have one:

# Before
FROM ubuntu:22.04@sha256:abc123...
# After  
FROM ubuntu:24.04@sha256:def456...

But if you start with just a tag, you get just a tag back:

# Before
FROM ubuntu:22.04
# After
FROM ubuntu:24.04

This PR adds an experiment flag (docker_pin_digests) that makes Dependabot add digests to tag-only images. When enabled:

# Before
FROM ubuntu:22.04
# After
FROM ubuntu:24.04@sha256:def456...

Fixes #14065

Anything you want to highlight for special attention from reviewers?

The code already knows how to fetch digests. UpdateChecker#digest_of(tag) does exactly this. The change is small:

1. updated_requirements now calls digest_of(updated_tag) when pin_digests? returns true (not just when there's an existing digest)
2. SharedFileUpdater#update_digest_and_tag appends @sha256:... when the old image had no digest but the new one does

I put it behind an experiment flag because it changes behavior for everyone using Docker.

How will you know you've accomplished your goal?

Added tests for:

• UpdateChecker#updated_requirements returns a digest for tag-only images when the flag is on
• UpdateChecker#updated_requirements returns no digest when the flag is off (existing behavior)
• FileUpdater correctly appends @sha256:... to Dockerfiles
• FileUpdater correctly appends @sha256:... to YAML files (Kubernetes, Helm)

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.