Support image digest in worker pod template image

[PreethamSanji]

Closes: #58625

The airflow_image helper supports repository@digest (digest takes precedence over tag), but pod_template_image only rendered repository:tag. As a result, worker pods created from the pod template ignored digests and could run stale images when a mutable tag like latest was reused.

This PR makes pod_template_image mirror airflow_image: it introduces images.pod_template.digest (added to values.yaml and values.schema.json — the schema has additionalProperties: false for this block), falling back to defaultAirflowDigest, consistent with the existing repository/tag fallback chains.

Before (helm template chart --set executor=KubernetesExecutor --set defaultAirflowRepository=my-repo --set defaultAirflowDigest=sha256:abc123):
helm template chart
--set executor=KubernetesExecutor
--set defaultAirflowRepository=my-repo
--set defaultAirflowDigest=sha256:abc123 2>/dev/null
| grep "image: my-repo" | sort -u
image: my-repo:3.3.0
image: my-repo@sha256:abc123

After (same values):
helm template chart
--set executor=KubernetesExecutor
--set defaultAirflowRepository=my-repo
--set defaultAirflowDigest=sha256:abc123 2>/dev/null
| grep "image: my-repo" | sort -u
image: my-repo@sha256:abc123

Runtime caveat, documented in the new value's description: the chart defaults config.kubernetes_executor.worker_container_repository/worker_container_tag to images.airflow.repository:tag, and when both are set the KubernetesExecutor overrides the pod template's base container image with that repo:tag string (kube_config.py builds kube_image; PodGenerator.construct_pod reconciles it over the base pod). Since repo:tag cannot express a digest, the digest only takes effect when those two config options are unset — the same pre-existing limitation already documented for images.pod_template.repository/tag. Making those config defaults digest-aware (defaulting them to empty when a digest is configured, so the template image wins) would fix the reporter's scenario with zero config changes, but it changes default behavior — happy to do that here or as a follow-up if preferred.

Tests: parametrized rendering tests in test_pod_template_file.py covering tag-only, digest-only, digest precedence over tag, and the defaultAirflowDigest fallback.

flower_image has the same gap; I'd address it separately if wanted.

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)
  Claude Fable 5

Generated-by: [Claude Fable 5] following the guidelines

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.