fix: validate digest-addressed manifest uploads

[KAJdev]

Validates digest-addressed manifest uploads against the SHA-256 computed from the request body before any manifest object is written. Mismatches return the OCI-compatible DIGEST_INVALID client error, preserving the integrity guarantee of digest-pinned pulls.

Addresses SLS-305.

[jebenexer]

LGTM — validation is placed correctly (after digest computation, before any JSON parse or R2 write), returns a proper OCI DIGEST_INVALID error, and the test verifies both the rejection and that neither the forged nor the real digest gets written to R2.

Two non-blocking notes:

1. Case sensitivity: comparison is case-sensitive against a sha256: prefix. Worth a quick test with an uppercase-hex digest to confirm/document that it's rejected as malformed rather than silently normalized — but rejecting is the safe default either way.
2. Direct-upload path bypass (pre-existing, not introduced here): finishUpload's state.direct path (r2.ts ~834-861) trusts the client-provided digest when R2 checksum metadata is missing, which is a separate integrity gap from what this PR fixes. Filing a follow-up ticket for that rather than blocking this PR on it.

Approving — this closes a real digest-spoofing gap for the standard upload path.

[jebenexer]

Filed the direct-upload bypass follow-up as SLS-468: https://linear.app/runpod/issue/SLS-468/serverless-registry-direct-upload-path-trusts-client-digest-when-r2