fix(materials): do not record container image digest as tag
When a container image material was attested by digest (image@sha256:...), the crafter recorded the digest string in the material's tag field, since ref.Identifier() returns the digest for digest references. The tag then surfaced through the chainloop.material.image.tag annotation and produced malformed pull-by-tag command hints (docker pull image:sha256:...) in the UI.
The tag is now only populated when the reference is an actual tag reference; digest references record no tag. Untagged references still default to latest.
This also fixes tag extraction from the io.containerd.image.name annotation in the OCI layout path, which naively split the reference on : and mistook registry ports and digests for tags. The reference is now parsed with go-containerregistry.