Clarify using tag in oci.pull

When using tools like renovate to update images in MODULE.bazel files, we need a tag to know what digest to update to. Currently the docs say `a tag to choose an image from the registry. Exactly one of tag and digest must be set. Since tags are mutable, this is not reproducible, so a warning is printed.`, however this no longer appears to be the case.

Even so, is it recommended to keep the tag one a separate line next to digest, or is it better to keep the tag in the image string?

either
```
oci.pull(
name = "java_base_nonroot_debian12",
digest = "sha256:25d27a193b1038842178110636be8c27f5a502e313eb413d3a31052d71d3d409",
image = "gcr.io/distroless/java-base-debian12:nonroot",
platforms = [
"linux/amd64",
"linux/arm64/v8",
],
)
```
or
```
oci.pull(
name = "java_base_nonroot_debian12",
digest = "sha256:25d27a193b1038842178110636be8c27f5a502e313eb413d3a31052d71d3d409",
image = "gcr.io/distroless/java-base-debian12",
platforms = [
"linux/amd64",
"linux/arm64/v8",
],
tag = "nonroot",
)
```

Start with the `oci.pull` documentation and the two invocation examples shown in the issue, then verify the current tag and digest behavior. Done means the documentation accurately describes whether tags may accompany digests and clearly recommends one of the two shown forms.

Written by the indexing model from the issue text.