Attempt to lookup cached entrypoint by digest, if possible

Today, when the step's image is not specified by digest (i.e., most of the
time), we issue an image pull to get the image's entrypoint, then cache
it. This means that when the step isn't specified by digest (i.e., most
of the time) we hit the remote registry, and can hit DockerHub's rate
limits.

With this change, we'll issue a HEAD request to the registry to first
lookup the digest of the image, then see if we already have the
entrypoint cached by that digest. If the HEAD request fails or the
entrypoint isn't found by image digest, we proceed as normal with the
image pull.

pkg/pod/entrypoint_lookup_impl.go

@@ -77,6 +77,18 @@ func (e *entrypointCache) Get(ctx context.Context, ref name.Reference, namespace
 		Architecture: runtime.GOARCH,
 		OS:           runtime.GOOS,
 	}
+
+	// Attempt to lookup the image's digest.
+	// - if HEAD request fails, proceed to GET with remote.Image below --
+	//   some registries don't support HEAD requests, but those with the
+	//   strictest rate limiting (DockerHub) do.
+	desc, err := remote.Head(ref, remote.WithAuthFromKeychain(mkc))
+	if err == nil {
+		if img, ok := e.lru.Get(desc.Digest.String()); ok {
+			return img.(v1.Image), nil
+		}
+	}
+
 	img, err := remote.Image(ref, remote.WithAuthFromKeychain(mkc), remote.WithPlatform(pf))
 	if err != nil {
 		return nil, fmt.Errorf("error getting image manifest: %v", err)