Image and feature digest pinning syntax inconsistency

Hey,

I think the behavior of Dev Container CLI for digest pinning is inconsistent between the image field and feature keys. For images, it accepts the following definition without a problem:

```
mcr.microsoft.com/devcontainers/python:1.1.10-3.12-bookworm@sha256:c5b8bd1aa0c5c56c18de49024d2d67873612107c492ad0d8946c78c495e6ff0c
```

However, when it comes to feature keys, the following definition is not valid:

```
ghcr.io/devcontainers/features/aws-cli:1.0.7@sha256:8d39e89cc98291953fb03cf7ef540dc1a7c78c3162f0eee9b61c800e4838f807
```

Feature keys require the following definition instead (which I've learned by digging into issues and finding #479 as I couldn't find any documentation on whether the features can be pinned), which omits the tag:

```
ghcr.io/devcontainers/features/aws-cli@sha256:8d39e89cc98291953fb03cf7ef540dc1a7c78c3162f0eee9b61c800e4838f807
```

If you were to pin the feature with its tag, you get the following error:

```
@devcontainers/cli 0.60.0. Node.js v18.18.2. darwin 23.4.0 arm64.
Start: Run: docker buildx version
github.com/docker/buildx v0.13.1-desktop.1 2368b2ee41873b948cb607251cec573ed00f00f9
...
Resolving Feature dependencies for 'ghcr.io/devcontainers/features/aws-cli:1.0.7@sha256:8d39e89cc98291953fb03cf7ef540dc1a7c78c3162f0eee9b61c800e4838f807'...
* Processing feature: ghcr.io/devcontainers/features/aws-cli:1.0.7@sha256:8d39e89cc98291953fb03cf7ef540dc1a7c78c3162f0eee9b61c800e4838f807
Path 'devcontainers/features/aws-cli:1.0.7' for input 'ghcr.io/devcontainers/features/aws-cli:1.0.7@sha256:8d39e89cc98291953fb03cf7ef540dc1a7c78c3162f0eee9b61c800e4838f807' failed validation. Expected path to match regex '/^[a-z0-9]+([._-][a-z0-9]+)*(\/[a-z0-9]+([._-][a-z0-9]+)*)*$/'.
Could not resolve Feature manifest for 'ghcr.io/devcontainers/features/aws-cli:1.0.7@sha256:8d39e89cc98291953fb03cf7ef540dc1a7c78c3162f0eee9b61c800e4838f807'. If necessary, provide registry credentials with 'docker login '.
```

Not being able to use the tag of the image within definitions with digests makes the implementation of automatic dependency management harder ([a Renovate discussion](https://github.com/renovatebot/renovate/discussions/28767)) and IMHO readability worse as you have no way of easily seeing which tag that feature is supposed to be. Would you consider changing this behavior?

Thanks! 🤗

首先，在 devcontainer.json 中使用两个 feature 定义重现该问题，并跟踪 Dev Container CLI 的 feature 依赖解析和路径验证输出。完成的标准是：feature reference 可以像 image references 一样始终保留其 tag 和 digest，同时现有的 digest-only 形式继续正常工作。

由索引模型根据 Issue 内容生成。