oci.pull doesn't work for some images running on Debian on WSL2

**Versions tried**:
```
bazel_dep(name = "rules_oci", version = "1.7.6")
bazel_dep(name = "rules_oci", version = "1.8.0")
```
**Bazel version**: 7.2.1

**Issue**:
I am trying to pull two images using Bazel on Debian running on WSL2. The distroless_cc image works, but the nginx image does not. A friend tested the same configuration on macOS and Linux with the same Bazel version, and it worked for him.

**Definition**:
```

oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
oci.pull(
name = "distroless_cc",
digest = "sha256:f7fa4923556853754e9ff647df410d5711fc4d99a8dafa777ec617cf4a6700f6",
image = "gcr.io/distroless/cc-debian11:nonroot",
platforms = [
"linux/amd64",
],
)
oci.pull(
name = "nginx",
digest = "sha256:6af79ae5de407283dcea8b00d5c37ace95441fd58a8b1d2aa1ed93f5511bb18c",
image = "docker.io/library/nginx:1.27.0",
platforms = [
"linux/amd64",
],
)
use_repo(oci, "distroless_cc")
use_repo(oci, "nginx")

```

**Error for bazel build @nginx**:

```
INFO: Repository rules_oci~~oci~nginx_linux_amd64 instantiated at:
: in
Repository rule oci_pull defined at:
/home/kshor/.cache/bazel/_bazel_kshor/9dbb2f1a485ec1872a1e9cfa8f1672c1/external/rules_oci~/oci/private/pull.bzl:281:27: in
ERROR: An error occurred during the fetch of repository 'rules_oci~~oci~nginx_linux_amd64':
Traceback (most recent call last):
File "/home/kshor/.cache/bazel/_bazel_kshor/9dbb2f1a485ec1872a1e9cfa8f1672c1/external/rules_oci~/oci/private/pull.bzl", line 256, column 29, in _oci_pull_impl
downloader.download_blob(manifest["config"]["digest"], config_output_path)
File "/home/kshor/.cache/bazel/_bazel_kshor/9dbb2f1a485ec1872a1e9cfa8f1672c1/external/rules_oci~/oci/private/pull.bzl", line 162, column 61, in lambda
download_blob = lambda identifier, output: _download(rctx, authn, identifier, output, "blobs"),
File "/home/kshor/.cache/bazel/_bazel_kshor/9dbb2f1a485ec1872a1e9cfa8f1672c1/external/rules_oci~/oci/private/pull.bzl", line 108, column 23, in _download
return download_fn(
File "/home/kshor/.cache/bazel/_bazel_kshor/9dbb2f1a485ec1872a1e9cfa8f1672c1/external/rules_oci~/oci/private/download.bzl", line 121, column 25, in _bazel_download
return rctx.download(**kwargs)
Error in download: com.google.devtools.build.lib.bazel.repository.downloader.UnrecoverableHttpException: Checksum was e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 but wanted a72860cb95fd59e9c696c66441c64f18e66915fa26b249911e83c3854477ed9a
ERROR: no such package '@@rules_oci~~oci~nginx_linux_amd64//': com.google.devtools.build.lib.bazel.repository.downloader.UnrecoverableHttpException: Checksum was e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 but wanted a72860cb95fd59e9c696c66441c64f18e66915fa26b249911e83c3854477ed9a
ERROR: /home/kshor/.cache/bazel/_bazel_kshor/9dbb2f1a485ec1872a1e9cfa8f1672c1/external/rules_oci~~oci~nginx/BUILD.bazel:1:6: @@rules_oci~~oci~nginx//:nginx depends on @@rules_oci~~oci~nginx_linux_amd64//:nginx_linux_amd64 in repository @@rules_oci~~oci~nginx_linux_amd64 which failed to fetch. no such package '@@rules_oci~~oci~nginx_linux_amd64//': com.google.devtools.build.lib.bazel.repository.downloader.UnrecoverableHttpException: Checksum was e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 but wanted a72860cb95fd59e9c696c66441c64f18e66915fa26b249911e83c3854477ed9a

```

Any guidance on debugging this issue would be appreciated.

Reproduce the failure with the two oci.pull definitions and bazel build @nginx on Debian under WSL2. Start by reading oci/private/pull.bzl at the config blob download and oci/private/download.bzl at _bazel_download; compare the requested and returned checksums. Done means the nginx repository fetch succeeds without changing the pinned digest.

Written by the indexing model from the issue text.