ci(renovate): Force image digest pinning

This patch enables digest pinning for renovate updates, this should help
to keep everything updates even while using mutable tags, such as
`stable` for CoreOS.

renovate.json

@@ -57,6 +57,10 @@
         "rook-ceph-cluster"
       ],
       "groupName": "rook-ceph"
+    },
+    {
+      "matchPaths": ["images/kos/**"],
+      "extends": ["docker:pinDigests"]
     }
   ]
 }