Resolve dependent images (pre_start hooks, type: image volumes) in WithImagesResolved

[ndeloof]

What I did

Project.WithImagesResolved only resolved the top-level service.Image, but a service can depend on other images that should be pinned by docker compose config --resolve-image-digests too:

• pre_start hook images — hooks run as ephemeral init containers with their own image (ServiceHook.Image)
• type: image volume sources — these mount an image referenced by the volume source

This PR extracts the single-image digest resolution into a resolveImageDigest helper and applies it to the service image, each pre_start hook image, and each type: image volume source.

• Hooks without an explicit image fall back to the service image at runtime, so they are left untouched (empty in → empty out).
• type: image volume sources that reference another service by name are resolved to a locally built image, not a registry digest, so they are skipped.
• Already-canonical (digested) references and empty images are returned unchanged, preserving the existing behaviour for the service image.
• The original Project stays unchanged: WithServicesTransform operates on a deepCopy, whose PreStart/Volumes slices have their own backing arrays, so the in-place updates never touch the caller's project.

Motivation

Downstream in Docker Compose, pre_start hook images are otherwise ignored by image resolution (see docker/compose#13924 / docker/compose#13937). That PR handles config --images, pull and up, but digest resolution/locking has to be done here because WithImagesResolved is the single place where digests are computed. The type: image volume case is the same class of dependent-image resolution.

Tests

• Test_ResolveImages_preStartHooks: a service with image: alpine:3.20 and two pre_start hooks (one with image: alpine:3.19, one without an image) — asserts the service image and the explicit hook image are both resolved to ...@sha256:..., and the image-less hook is left empty.
• Test_ResolveImages_imageVolumes: a service with three volumes — an external type: image source (alpine:3.19, resolved to a digest), a type: image source referencing another service (builder, left untouched), and a plain named volume (left untouched).