DL3045 - COPY --from without digest pinning for external image

Use a digest when copying from an external image with COPY --from. Add @sha256:<digest> to the image reference to ensure reproducible builds.

(c) 2025 Asymmetric Effort, LLC. scaldwell@asymmetric-effort.com