Resolve container tags to immutable @sha256 digests via OCI API in ho… (#2749)

…st mode

When execution mode is 'host', container image tags (e.g. :latest) are
resolved to immutable @sha256 digests by querying the container
registry's OCI V2 manifest API (HTTP header docker-content-digest). This
prevents remote build failures on RBE execution servers that reject
unpinned container image tags.