lint: add new lint to check if uri contains any hard-coded digests

[Dentrax]

Description

melange convert python <PACKAGE> generated melange manifest, sometimes contains the digest in the uri:

  - uses: fetch
    with:
      expected-sha256: 942c5a758f98d790eaed1a29cb6eefc7ffb0d1cf7af05c3d2791656dbd6ad1e1
      uri: https://files.pythonhosted.org/packages/9d/be/10918a2eac4ae9f02f6cfe6414b7a155ccd8f7f9d4380d62fd5b955065c3/requests-${{package.version}}.tar.gz

So that contains a SHA means that the Wolfi bot won't be able to auto-update the package.

AFAICSC, the following packages has affected:

• py3-aiohttp
• py3-aiosignal
• py3-async-timeout
• py3-asynctest
• py3-attrs
• py3-frozenlist
• py3-idna-ssl
• py3-idna
• py3-llhttp
• py3-multidict
• py3-openai
• py3-pyperclip
• py3-requests
• py3-ruamel-yaml
• py3-tqdm
• py3-typing
• py3-yarl

cc @rawlingsj