Renovate pin digest settings

With the current settings, renovate will pin digests for any image with a numeric version. But some cases that match do not need pinning, e.g. node:19-alpine or docker:20.10.21-alpine3.16. Renovate seems to be stuck in a loop trying to pin them, so should add specific exceptions.