Docker images in manifest file allow mismatched tag + sha

[awrichar]

The manifest.json format allows specifying a Docker version by tag or sha. If the sha is set, the tag is ignored, as seen in this method to generate the image name for the docker-compose file:

firefly-cli/pkg/types/manifest.go

Line 55 in 03797a8

func (m *ManifestEntry) GetDockerImageString() string {

This can be confusing if tag and sha are both set but refer to two different images. Ideally if both are set, there would be some verification that they point to the same image.

If this is not feasible, perhaps we should adjust the manifest.json to only contains sha (even though it's not as human-readable).