Pull container image when out of date

[JamieMagee]

This change adds an additional step to the pullImage function to query the relevant container registry and find the current digest for the tag we specify. We then compare it with the digest of the image we have locally. If they don't match, we attempt to pull the image.

[jakecoffman]

I just tested this locally, since I build local ARM versions I'd have to remember to add --pull=false to test things I am building locally. Is it as this point we add a dependabot config command to set ~/.dependabot configurable defaults?

[JamieMagee]

No, that's going to add too much complexity IMO. I'll have to do:

	Exists locally	Doesn't exist locally
Exists remotely	Compare digest	Pull
Doesn't exist remotely	Continue with local image	🤷

[JamieMagee]

I've updated this PR to compare digests first, instead of just blindly pulling the latest container.

[JamieMagee]

Smoke test failures appear to be unrelated to my changes.