Pin image volume sources in config

[ousamabenyounes]

Summary

• Resolve type: image volume sources when config --resolve-image-digests pins image tags.
• Preserve pinned image volume sources in --lock-image-digests output while dropping non-image volumes.
• Add unit coverage for both resolve and lock paths.

Fixes #13827

Test verification (RED -> GREEN)

• Baseline: make test passed with DONE 497 tests, 2 skipped before changes.
• RED: new focused test failed before the production fix because the image volume source stayed alpine:latest instead of the pinned Docker Hub alpine digest reference, and the expected registry inspect call for docker.io/library/alpine:latest was missing.
• Revert proof: reverting the production change made the focused tests fail again, including the unresolved image volume source assertion.
• GREEN: focused tests passed: TestResolveImageDigestsPinsImageVolumeSources, TestImagesOnlyKeepsImageVolumeSources, and TestLockModelOnlyKeepsImageVolumeSources.
• Full suite: make test passed with DONE 500 tests, 2 skipped after changes.