feat(ecs): accept a resolvable ContainerDefinition.image

[JeroenSoeters]

Summary

AWS::ECS::TaskDefinition's ContainerDefinition.image was typed as a bare
String, the only reference-shaped field left on the task definition family
that was not a String|formae.Resolvable union. Its siblings
(Secret.valueFrom, RepositoryCredentials.credentialsParameter,
EFSVolumeConfiguration.filesystemId, TaskDefinition.executionRoleArn and
taskRoleArn) all accept a resolvable already.

The practical cost: nothing could wire a built image into a task definition. An
AWS::CodeBuild::ImageBuild publishes a digest and an AWS::ECR::Repository
publishes a URI, but neither could reach the image field. Passing a Resolvable
failed PKL type checking, and interpolating one into a string shipped the framed
envelope to RegisterTaskDefinition verbatim, which AWS rejects as invalid
characters. The workaround was to resolve the digest out of band, pin it as a
literal, and re-pin it by hand on every image rebuild.

Widening the type to String|formae.Resolvable removes that hand-edit.

Also adds a conformance fixture, testdata/ecs-taskdefinition-image-ref.pkl,
which creates an ECR repository from scratch and points the container image at
its resolved repositoryUri, so an apply fails outright if the reference does
not resolve. Confirmed it is a real regression test: it fails to evaluate
against the old bare-String type and passes with the new one. Fargate refuses
an ECR image without an execution role, so the fixture declares one; that
requirement is AWS's and is unrelated to the reference resolving.

The full conformance CRUD run passes (Create, Verify, Extract, Sync, Destroy and
out-of-band delete green; Update and Replace skipped, as there is no -update
variant, matching the sibling ecs-taskdefinition-secret-arn fixture).