MCO erroneously allows tagged pull spec, should only allow digest

When we create a new MC deploying a new osImage the worker pool becomes degraded.

4.12.0-0.nightly-2022-09-28-204419

Always

1. Get the base osImage

$ oc adm release info --pullspecs 2> /dev/null| grep rhel
   rhel-coreos-8                                  quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1fb581c9bb638471be0f647d5ced2a16dcbc23c6923398066baf62cb6c7149c6

2. Use the base osImage to create a new one using this docker file

FROM base_image_found_in_step_1

 RUN mkdir /etc/tc_54085 && chmod 3770 /etc/tc_54085 && ostree container commit


 RUN echo 'Test case 54085 test file' > /etc/tc54085.txt && 
chmod 5400 /etc/tc54085.txt && ostree container commit

 
RUN echo 'echo "Hello world"' > /usr/bin/tc54085_helloworld 
&& chmod 5770 /usr/bin/tc54085_helloworld && ostree 
container commit

 RUN cd /etc/yum.repos.d/ && curl -LO https://pkgs.tailscale.com/stable/fedora/tailscale.repo && \
     rpm-ostree install tailscale && rpm-ostree cleanup -m && \
     systemctl enable tailscaled && \
     ostree container commit

3.Push the resulting image to a docker registry

4. Create a new MC to deploy this osImage

cat <<EOF | oc create -f -
 kind: MachineConfig
 apiVersion: machineconfiguration.openshift.io/v1
 metadata:
   labels:
     machineconfiguration.openshift.io/role: "worker"
   name: "tc-54085-new-os-image"
 spec:
   osImageURL: "quay.io/sregidor/sregidor-os:mco_layering" << USE YOUR IMAGE HERE
 EOF

The worker pool becomes degraded:

$ oc get mcp worker
NAME     CONFIG                                             UPDATED   UPDATING   DEGRADED   MACHINECOUNT   READYMACHINECOUNT   UPDATEDMACHINECOUNT   DEGRADEDMACHINECOUNT   AGE
worker   rendered-worker-24231b9ff533afe05c7ad3de11b52db9   False     True       True       3              2                   2                     1                      124m

$ oc get mcp worker -o yaml
...
  - lastTransitionTime: "2022-09-30T10:34:15Z"
    message: 'Node ip-10-0-157-128.us-east-2.compute.internal is reporting: "failed
      to update OS to quay.io/mcoqe/layering : error running rpm-ostree rebase --experimental
      ostree-unverified-registry:quay.io/mcoqe/layering: \x1b[0m\x1b[31merror: \x1b[0mOld
      and new refs are equal: ostree-unverified-registry:quay.io/mcoqe/layering\n:
      exit status 1"'
    reason: 1 nodes are reporting degraded status on sync
    status: "True"
    type: NodeDegraded

The MC should apply the new osImage without problems and the worker pool should never be degraded.

The cluster is an IPI AWS cluster with OVN