feat: keep Docker images on computes consistent with the controller host

Only relying on the image name lets a moved tag (e.g. a newer :latest)
silently serve stale content from a compute that already has an image
under the same name. When creating a Docker node, the controller now
pins the image id (Id from the Docker daemon on the controller host)
into the create payload. A compute holding a different image under the
same tag reports the image as missing, which routes it through the
image sync added by the previous commit and re-aligns the tag.

No new template fields or database changes: the controller host daemon
remains the source of truth and the pin is resolved per creation. When
the image is not available on the controller host the pin is omitted
and behavior is unchanged (the compute pulls from the repository).

tests/compute/docker/test_docker_vm.py

@@ -564,6 +564,38 @@ async def test_create_image_not_available(compute_project, manager):
         query_mock.assert_not_called()
 
 
+@pytest.mark.asyncio
+async def test_create_image_digest_match(compute_project, manager):
+
+    response = {
+        "Id": "sha256:" + "a" * 64,
+        "Warnings": []
+    }
+    with asyncio_patch("gns3server.compute.docker.Docker.query", return_value=response) as mock:
+        vm = DockerVM("test", str(uuid.uuid4()), compute_project, manager, "ubuntu:latest",
+                      image_digest="sha256:" + "a" * 64)
+        await vm.create()
+        # the last query is the container creation: the digest check let it through
+        assert mock.call_args[0] == ("POST", "containers/create?name={}".format(vm.docker_name))
+        assert vm._cid == "sha256:" + "a" * 64
+
+
+@pytest.mark.asyncio
+async def test_create_image_digest_mismatch(compute_project, manager):
+
+    response = {
+        "Id": "sha256:" + "b" * 64,
+        "Warnings": []
+    }
+    vm = DockerVM("test", str(uuid.uuid4()), compute_project, manager, "ubuntu:latest",
+                  image_digest="sha256:" + "a" * 64)
+    with asyncio_patch("gns3server.compute.docker.Docker.query", return_value=response) as query_mock:
+        with pytest.raises(ImageMissingError, match="ubuntu:latest"):
+            await vm.create()
+        # only the image inspect happened: no container was created from the stale image
+        query_mock.assert_called_once_with("GET", "images/ubuntu:latest/json")
+
+
 @pytest.mark.asyncio
 async def test_create_with_user(compute_project, manager):