FR: support automatically passing digest to the underlying oci_pull under bzlmod

I am writing some automation that generates a lot of `oci.pull` calls in the `MODULE.bazel` and I would like to only need to specify the `tag` to the `oci.pull` rule but I would like `rules_oci` to get the `digest` within the context of the module extension and pass it to the underlying `oci.pull` rule so that the `digest` is recorded in the `MODULE.bazel.lock` file and I can benefit from caching within my code. This could also help with other automation that works mainly with tags.

Let me know if you would like me to explain more about my usecase.

Potentially related #510.

Read the module-extension path that implements oci.pull and the bzlmod lockfile behavior; the issue names MODULE.bazel and MODULE.bazel.lock but no source file or test. Reproduce a generated tag-only oci.pull call and verify that the resulting lock file records a digest and supports the requested caching behavior.

Written by the indexing model from the issue text.