The checksum validation for Docker images is broken because we use crane manifest repo:tag@sha256:digest which gets the file by checksum (the checksum from the makefile) rather than by tag....so the checksum always matches.
But the image is then pulled by reference to its tag, so although the local image on the filesystem will be the right version,
we won't detect if someone has pushed a different image to the registry using the same tag.

The problem is demonstrated in this PR follows:

1. Updated only the semver tag of the ingress-nginx image and Helm chart. Did not update the sha256 sum of the images.
2. Expected the build to fail because of a checksum validation. But it passed.
3. Updated the checksum validation. The checksum test still passes, because the script this time loads the cached image which the previous CI run downloaded and cached with the wrong checksum in the filename.
4. Updated the checksums. Expect the checksum validation to pass and the image to be downloaded again but with new filename containing new checksum.

I also removed the multi-arch variant of the image-download rule because it was also broken which had been obscuring the fact that we were supplying it with digests of single-arch vault and kind images.

Testing

There were a couple of test flakes, which I assume was caused by Prow jobs getting killed (or something):

• https://prow.build-infra.jetstack.net/pr-history/?org=cert-manager&repo=cert-manager&pr=6440

I deleted _bin/ and tested locally and everything worked.

 rm -rf _bin/
make -j e2e-setup
make e2e GINKGO_FOCUS="Vault\ Issuer"
...
Ran 25 of 778 Specs in 51.981 seconds
SUCCESS! -- 25 Passed | 0 Failed | 0 Pending | 753 Skipped
--- PASS: TestE2E (52.02s)
PASS

Ginkgo ran 1 suite in 1m27.4800163s
Test Suite Passed

NONE