feat: use digests instead of tags for pinned images

[mayeut]

A number of improvements regarding the supply-chain security have already made it into v4.0.0
This pull request extends those by using digests rather than tags for pinned images.

The major drawbacks are UX and test maintenance/complexity:

• UX: the summary used to come with a user readable image tag. Digests are not human friendly and the added complexity to manage both tags and digests for this summary might not be worth it. The tags have nevertheless been added as comments in cibuildwheel/resources/pinned_docker_images.cfg in order to get the mapping somewhere, similar to what exists in workflow files.
• Test maintenance/complexity: in order to speed-up CI, docker images were pulled once and mutated in order to avoid downloading missing interpreters in every tests and get a cache for the most commonly used wheels. We can't mutate images referenced by digest and thus, to keep this caching behaviour for tests, the fixture now monkey patch the pinned image configuration using the newly introduced CIBW_INTERNAL_PINNED_DOCKER_IMAGES environment variable.

Other solution considered: use immutable tags for pypa/manylinux images but, while Quay itself seems to support the feature, quay.io does not offer such setting.

[mayeut]

I applied all optional labels to get another CI run using image cache (already tested on my fork while crafting this PR).
CI: PyPy EoL won't change a thing until #2930 but CI: GraalPy is enough to enable image cache.