After completing a build, the information we get back on the Component CR includes the image SHA. This allows a user to docker pull their image, but Quay won't resolve those links and rejects the request with a 403. 

Current format: quay.io/redhat-appstudio/user-workload@sha256:c43344fa96fcbfaad8ee3ad388638e20e4b70c1b7ae8221cde1a1acb6a59db2a

I think we can construct a valid (and useful) link for the user, based on that digest though, we can take the user to https://quay.io/repository/redhat-appstudio/user-workload/manifest/sha256:c43344fa96fcbfaad8ee3ad388638e20e4b70c1b7ae8221cde1a1acb6a59db2a which is a direct link.

There's a related issue where HAS is providing a built container image URL while the build is ongoing, which changes to display the SHA once it completes.

There was a long discussion on this here: https://redhat-internal.slack.com/archives/C038DJAP7HR/p1673452387689769