[ECR] [request]: pull-through cache — support digest-pinned images on first pull

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**

Allow a pull-through cache rule to populate the cache when an image is referenced by digest (`@sha256:…`), not only when it's pulled by tag. A first pull of an uncached manifest by digest should fetch that manifest from the upstream registry, verify it, and cache it — the same way a tag pull does today.

This also happens when an image has both a tag and a digest -- an uncached image returns as missing, even though the tag also is included and could be used.

**Which service(s) is this request for?**
ECR (pull-through cache)

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

Many helm charts are starting to move to digest-pinned images for increased security, to prevent supply-side attacks. Today, pull-through cache only imports on a tag pull, so a digest reference for an image the cache hasn't already seen fails (`manifest unknown`, or a redirect upstream that times out on nodes with no internet route).

The workaround is to pre-warm every image by pulling its tag before the digest ref is used. This is not always feasible, or at best is a lot of extra automation work. The solutions that are implemented for it create more places things can break in the future, making what should be a simplifying solution more complex and brittle.

There are likely to be more and more helm charts pinning to digests, and therefore, this will be an increasing problem for the community.

**Are you currently working around this issue?**

Yes — pre-pulling images by tag to warm the cache before any digest-pinned reference resolves, per region.

**Additional context**

Related symptoms reported as bugs: aws/containers-roadmap #2304 (digest pull redirects upstream), #2053 (cross-account uncached pulls), GoogleContainerTools/kaniko#2994 (first-pull fails until warmed by tag).

**Attachments**

Start by reproducing an uncached ECR pull-through cache request using an image digest, including a reference containing both a tag and digest. Review the related issues linked in the report and trace the ECR pull-through cache behavior; done means the first digest-pinned pull fetches, verifies, and caches the upstream manifest without requiring a tag pre-pull.

Written by the indexing model from the issue text.