Instead of using the image name and tag, use the image name and the
manifest sha256. This allows to verify the image sha256 in logs etc.
and gets rid of the following warning from cosign:

```
WARNING: Image reference ghcr.io/home-assistant/amd64-builder:dev uses a tag, not a digest, to identify the image to sign.
```

Since we anyways can only sign an image which has a manifest digiest