Docker images in manifest file allow mismatched tag + sha

The manifest.json format allows specifying a Docker version by `tag` or `sha`. If the `sha` is set, the `tag` is ignored, as seen in this method to generate the image name for the docker-compose file:

https://github.com/hyperledger/firefly-cli/blob/03797a8484fb7df6d277d236d99a6fc79bdaa2bb/pkg/types/manifest.go#L55

This can be confusing if `tag` and `sha` are both set but refer to two different images. Ideally if both are set, there would be some verification that they point to the same image.

If this is not feasible, perhaps we should adjust the manifest.json to only contains `sha` (even though it's not as human-readable).