Request: backport 'Add support for using Digest for base image' to 9.0.1xx band

[tmds]

This feature was implemented in #44461 and is being included in the 9.0.2xx band with #45594.

The feature enables pinning the base image to a specific digest. This enables to control and determine the exact version of a container image tag that was used, which is important for software supply chain (SBOMs) and reproducibility of build environments.

This is a request to backport the feature to the 9.0.1xx band.

Rationale:

• Source-built SDKs are limited to the .1xx band. Unless it gets backported, the feature isn't available for source-built SDKs until .NET 10. If we backport it in our builds, we land on the next point*.

• The current behavior of the 9.0.1xx band is to ignore the digest rather than give an error. This makes it undetermined what digest was effectively used. It would be preferable to have the digest work across all 9.0 bands, rather than rely on the user to know the 9.0.1xx band doesn't support it (*: or know the source-built maintainers chose to backport it manually).

cc @baronfel @omajid @BeyondEvil

[baronfel]

Triggered the backport - thanks for the request!