Fix cog base layer hash (#1833)
* Add test to determine if the layer SHA is correct
* Test that an image built with use-cog-base-image
gives a valid SHA hash reflected within its layers
* This currently fails, will be tested against to
determine that the fix is working correctly.
* Fix cog base image layer hash reporting
- Previously code was fetching the manifest, then
the layers from the manifest, then the digest of
those layers.
- This is actually the hash of the manifest but
not of the layer itself.
- What we actually want is the DiffID (the
uncompressed hash) of the layer.
