keeping image latest always restarts service

Describe the Bug

#468 tried to fix an issue with noop but now introduced that the exec is always triggered if using latest.

Expected Behavior

Exec does not propagate a refresh if nothing updates, and nothing gets changed during a run:

Service gets notified by image - idea is that service should get restarted when image changes.

Docker::Image<| title == split($real_image,':')[0] |> ~> Service["docker-${name}"]

BUT service even gets restarted when image is not changed (Status: Image is up to date for registry.code.immerda.ch/immerda/container-images/gitlab:latest), because the notify resource still triggers as a change. Which has also the sideeffect that the node always counts as changed and never has 0 changes.

Notice: Check if image registry.code.immerda.ch/immerda/container-images/gitlab:latest is in-sync
Notice: /Stage[main]/Ib_gitlab::Base/Docker::Image[registry.code.immerda.ch/immerda/container-images/gitlab]/Notify[Check if image registry.code.immerda.ch/immerda/container-images/gitlab:latest is in-sync]/message: defined 'message' as 'Check if image registry.code.immerda.ch/immerda/container-images/gitlab:latest is in-sync'
Info: /Stage[main]/Ib_gitlab::Base/Docker::Image[registry.code.immerda.ch/immerda/container-images/gitlab]/Notify[Check if image registry.code.immerda.ch/immerda/container-images/gitlab:latest is in-sync]: Scheduling refresh of Exec[echo 'Update of registry.code.immerda.ch/immerda/container-images/gitlab:latest complete']
Debug: /Stage[main]/Ib_gitlab::Base/Docker::Image[registry.code.immerda.ch/immerda/container-images/gitlab]/Notify[Check if image registry.code.immerda.ch/immerda/container-images/gitlab:latest is in-sync]: The container Docker::Image[registry.code.immerda.ch/immerda/container-images/gitlab] will propagate my refresh event
Debug: /Stage[main]/Ib_gitlab::Base/Docker::Image[registry.code.immerda.ch/immerda/container-images/gitlab]/Exec[echo 'Update of registry.code.immerda.ch/immerda/container-images/gitlab:latest complete']: 'echo 'Update of registry.code.immerda.ch/immerda/container-images/gitlab:latest complete'' won't be executed because of failed check 'refreshonly'
Debug: Exec[echo 'Update of registry.code.immerda.ch/immerda/container-images/gitlab:latest complete'](provider=posix): Executing check '/usr/local/bin/update_docker_image.sh registry.code.immerda.ch/immerda/container-images/gitlab:latest'
Debug: Executing: '/usr/local/bin/update_docker_image.sh registry.code.immerda.ch/immerda/container-images/gitlab:latest'
Debug: /Stage[main]/Ib_gitlab::Base/Docker::Image[registry.code.immerda.ch/immerda/container-images/gitlab]/Exec[echo 'Update of registry.code.immerda.ch/immerda/container-images/gitlab:latest complete']/onlyif: Trying to pull repository registry.code.immerda.ch/immerda/container-images/gitlab ... 
Debug: /Stage[main]/Ib_gitlab::Base/Docker::Image[registry.code.immerda.ch/immerda/container-images/gitlab]/Exec[echo 'Update of registry.code.immerda.ch/immerda/container-images/gitlab:latest complete']/onlyif: sha256:f09e666210135cd89377767dad8cf06d5b4dc64cfbdd67c8f7ae3fc0f0b58ca9: Pulling from registry.code.immerda.ch/immerda/container-images/gitlab
Debug: /Stage[main]/Ib_gitlab::Base/Docker::Image[registry.code.immerda.ch/immerda/container-images/gitlab]/Exec[echo 'Update of registry.code.immerda.ch/immerda/container-images/gitlab:latest complete']/onlyif: Digest: sha256:f09e666210135cd89377767dad8cf06d5b4dc64cfbdd67c8f7ae3fc0f0b58ca9
Debug: /Stage[main]/Ib_gitlab::Base/Docker::Image[registry.code.immerda.ch/immerda/container-images/gitlab]/Exec[echo 'Update of registry.code.immerda.ch/immerda/container-images/gitlab:latest complete']/onlyif: Status: Image is up to date for registry.code.immerda.ch/immerda/container-images/gitlab:latest
Debug: /Stage[main]/Ib_gitlab::Base/Docker::Image[registry.code.immerda.ch/immerda/container-images/gitlab]/Exec[echo 'Update of registry.code.immerda.ch/immerda/container-images/gitlab:latest complete']/onlyif: No updates to registry.code.immerda.ch/immerda/container-images/gitlab:latest available. Currently on sha256:c075f1d3906617823dd2e805f9e42531e36959458ab1de2d5ce7e06b8f6271f1.
Debug: /Stage[main]/Ib_gitlab::Base/Docker::Image[registry.code.immerda.ch/immerda/container-images/gitlab]/Exec[echo 'Update of registry.code.immerda.ch/immerda/container-images/gitlab:latest complete']: 'echo 'Update of registry.code.immerda.ch/immerda/container-images/gitlab:latest complete'' won't be executed because of failed check 'onlyif'
Notice: /Stage[main]/Ib_gitlab::Base/Docker::Image[registry.code.immerda.ch/immerda/container-images/gitlab]/Exec[echo 'Update of registry.code.immerda.ch/immerda/container-images/gitlab:latest complete']: Triggered 'refresh' from 1 event
Debug: /Stage[main]/Ib_gitlab::Base/Docker::Image[registry.code.immerda.ch/immerda/container-images/gitlab]/Exec[echo 'Update of registry.code.immerda.ch/immerda/container-images/gitlab:latest complete']: The container Docker::Image[registry.code.immerda.ch/immerda/container-images/gitlab] will propagate my refresh event
Debug: Docker::Image[registry.code.immerda.ch/immerda/container-images/gitlab]: The container Class[Ib_gitlab::Base] will propagate my refresh event
Info: Docker::Image[registry.code.immerda.ch/immerda/container-images/gitlab]: Scheduling refresh of Service[docker-gitlab]

This is on latest master using puppet 6.9.0

CC @electrofelix

Start with the Docker::Image resource and the Notify/Exec refresh chain described in the report, reproducing it with Puppet 6.9.0 and the latest master. Trace why an unchanged latest image still emits a refresh, then verify that an in-sync run leaves the service untouched and reports no change.