Validate live container digests during gh aw update

[Copilot]

gh aw update already verified action SHAs after rewriting actions-lock.json, but container pins were only checked structurally. That allowed newly added or stale container entries to survive update even when their stored digest no longer matched the current image.

• What changed

  • Extended post-update lock validation to re-resolve container image digests, alongside existing action SHA verification.
  • Added a container-specific resolver to the validation path so update can compare containers[*].digest against the live registry value.

• Behavior change

  • A container pin now fails update validation when:
    • the entry is malformed, or
    • the image resolves successfully and its current digest differs from the stored digest.
  • Structural-only validation paths continue to skip live registry checks.

• Regression coverage

  • Added cases for:
    • matching live digest → validation passes
    • resolver/network failure → validation is skipped as non-fatal
    • digest mismatch → validation reports the container pin as invalid

resolvedDigest, err := r.resolveContainerDigest(ctx, image)
if err != nil {
	updateValidationLog.Printf("container pin %q: skipping digest check (resolution failed): %v", image, err)
} else if !strings.EqualFold(resolvedDigest, pin.Digest) {
	issues = append(issues, fmt.Sprintf(
		"container pin %q digest mismatch: image resolves to %q but stored digest is %q",
		image, resolvedDigest, pin.Digest,
	))
}