container images are not pinned

[KnicKnic]

Container images should include the sha256 so that if there is a supply chain attack users are less vulnerable.

Ex: image: envoyproxy/envoy-alpine:v1.18.3
Should be - image: envoyproxy/envoy-alpine:v1.18.3@sha256:6225750f76e1e995690ce4a512aaff3ba5d9d70426926ec821b867346a703c0e

In this current instance this is made more problematic by specifying ALWAYS for image pull policy, meaning the second the container is updated with malicious payload it can be pulled down when a pod is created.

Scope (please mark with X where applicable)

• New Functionality [ x ]

[shashankram]

The scope of the issue is a bit larger given that updating the control plane image references to use the image digest requires the following additional tasks to be completed:

1. Remove image references from Go code (should only be derived from chart values or user input)
2. Tweak release process to use image digests