Attempt to lookup cached entrypoint by digest, if possible

[imjasonh]

Today, when the step's image is not specified by digest (i.e., most of the
time), we issue an image pull to get the image's entrypoint, then cache
it. This means that when the step isn't specified by digest (i.e., most
of the time) we hit the remote registry, and can hit DockerHub's rate
limits.

With this change, we'll issue a HEAD request to the registry to first
lookup the digest of the image, then see if we already have the
entrypoint cached by that digest. If the HEAD request fails or the
entrypoint isn't found by image digest, we proceed as normal with the
image pull.

/kind feature

Fixes #4187

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• [n] Docs included if any changes are user facing
• [n] Tests included if any functionality added or changed
• [y] Follows the commit message standard
• [y] Meets the Tekton contributor standards (including
  functionality, content, code)
• [y] Release notes block below has been filled in or deleted (only if no user facing changes)

Release Notes

Attempt to avoid incurring a rate limited image pull to lookup cached image entrypoints, if we can avoid it.

[vdemeester]

/meow

[tekton-robot]

@vdemeester:

In response to this:

/meow

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [vdemeester]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[imjasonh]

Worth noting: if the image is a multi-arch image (like ubuntu, alpine, etc.), then remote.Head will return the index's digest, which will never be populated in the cache. 😢 This is because the remote.Image we call later uses WithPlatform of the worker node's OS+arch, and returns the platform-specific image (not index), which gets returned and set in the cache in entrypoint_lookup.go.

So this is likely not a full solution to the problem, but should help in the case of single-platform images. We can't seem to resolve index->image (by platform) without a remote GET, which incurs the rate limit hit.

[dlorenc]

/lgtm

nice!

[vdemeester]

/lgtm