feat: implement digest pinning for Kubernetes component images

[pranav767]

Solves #1579
Does pinning for all Kubernetes component images.

OMNICONFIG=omniconfig ./_out/omnictl-linux-amd64 --insecure-skip-tls-verify get kubernetesversions 1.31.4 -o yaml 2>&1
metadata:
    namespace: default
    type: KubernetesVersions.omni.sidero.dev
    id: 1.31.4
    version: 1
    owner: VersionsController
    phase: running
    created: 2025-12-19T09:31:08Z
    updated: 2025-12-19T09:31:07Z
spec:
    version: 1.31.4
    componentimages:
        kube-apiserver: registry.k8s.io/kube-apiserver:v1.31.4@sha256:ace6a943b058439bd6daeb74f152e7c36e6fc0b5e481cdff9364cd6ca0473e5e
        kube-controller-manager: registry.k8s.io/kube-controller-manager:v1.31.4@sha256:4bd1d4a449e7a1a4f375bd7c71abf48a95f8949b38f725ded255077329f21f7b
        kube-proxy: registry.k8s.io/kube-proxy:v1.31.4@sha256:1739b3febca392035bf6edfe31efdfa55226be7b57389b2001ae357f7dcb99cf
        kube-scheduler: registry.k8s.io/kube-scheduler:v1.31.4@sha256:1a3081cb7d21763d22eb2c0781cc462d89f501ed523ad558dea1226f128fbfdd
        kubelet: ghcr.io/siderolabs/kubelet:v1.31.4@sha256:346676130195670ee7a1005946d1059a22983c32ec8c6a91a2e1bd8d4ac353bd
    signaturevalid: false

Yet to do : validate the image signatures before pinning them.

[pranav767]

Moving this to draft PR, still needs some work to be done around validating image signatures.

[CLAassistant]

All committers have signed the CLA.