enforce docker sha for decision images

[escapewindow]

We have the reference-browser decision image tagged, but not pinned to a sha. We used to have a sha allowlist, and then removed that in favor of the sha being in the gecko .taskcluster.yml. We should probably enforce having a sha here.

There are actually three docker shas: the compressed artifact sha, and then docker has 2 different shas for an image: one with metadata and one without, iirc. I believe we want this one, but we should verify:

docker inspect --format='{{index .RepoDigests 0}}' $IMAGE

from here. Also see https://stackoverflow.com/questions/42879587/what-does-each-sha-mean-in-a-docker-image

Order of operations:

• audit all cot-enabled repos for their decision shas
• add the appropriate shas to the .taskcluster.yml files, and document how to update
• enforce having a sha