use lowercase imageRef since docker does not support capital letters

[bobcallaway]

Per issue reported in sigstore/cosign-installer, docker push doesn't support references with uppercase characters.

bcallaway@bcallaway01:~/git/sigstore/cosign$ COSIGN_EXPERIMENTAL=1 ./cosign sign ghcr.io/bobcallaway/Custom-Error-Page@sha256:0dd6830f13edeb8a272586a5fe39a15dc3a0a8308be467c9117e7355c5ad9a68
Generating ephemeral keys...
Retrieving signed certificate...
Your browser will now be opened to:
https://oauth2.sigstore.dev/auth/auth?access_type=online&client_id=sigstore&code_challenge=L7k6KnuoCh8MizCXno9R7TJvO7fiZiSYVfG0abWRY_8&code_challenge_method=S256&nonce=24klxgjpuRfR63Y4TzvOoAQN7Hw&redirect_uri=http%3A%2F%2Flocalhost%3A35411%2Fauth%2Fcallback&response_type=code&scope=openid+email&state=24klxjEVeLvfgKtoxNzfF6sMHDD
Successfully verified SCT...
Error: signing [ghcr.io/bobcallaway/Custom-Error-Page@sha256:0dd6830f13edeb8a272586a5fe39a15dc3a0a8308be467c9117e7355c5ad9a68]: parsing reference: could not parse reference: ghcr.io/bobcallaway/Custom-Error-Page@sha256:0dd6830f13edeb8a272586a5fe39a15dc3a0a8308be467c9117e7355c5ad9a68
main.go:46: error during command execution: signing [ghcr.io/bobcallaway/Custom-Error-Page@sha256:0dd6830f13edeb8a272586a5fe39a15dc3a0a8308be467c9117e7355c5ad9a68]: parsing reference: could not parse reference: ghcr.io/bobcallaway/Custom-Error-Page@sha256:0dd6830f13edeb8a272586a5fe39a15dc3a0a8308be467c9117e7355c5ad9a68

There isn't really a useful error message to assist in debugging.

We can either check for uppercase characters and fail with a helpful error message, or we could transform the image ref to be in all lowercase characters before pushing the signature.

[dlorenc]

cc @mattmoor @jonjohnsonjr I thought we saw this back in December and fixed it in ggcr somewhere...

[mattmoor]

We didn’t because the starter action uses some metadata action to normalize instead

[dlorenc]

Ah whoops!