Use Docker digest instead of tag to attest provenance

[thardeck]

Refers to #3075

To fix the warning:

WARNING: Image reference ***/***/fleet:v0.12.0-alpha.7-linux-amd64 uses a tag, not a digest, to identify the image to sign.
    This can lead you to sign a different image than the intended one. Please use a
    digest (example.com/ubuntu@sha256:abc123...) rather than tag
    (example.com/ubuntu:latest) for the input to cosign. The ability to refer to
    images by tag will be removed in a future release.

docker inspect in this form should only work if the image is locally available so there should be no real threat of mixing up images.

Old Github Action output vs New Github Action output