ContainerUri [Clarity, Portability]
Ensures that values for the `container` key within `runtime`/`requirements` sections are well-formed.

This rule checks the following:

- Containers should have a tag, as container URIs with no tags have no expectation that the behavior of the containers won't change between runs.
- Further, immutable containers tagged with SHA256 sums are preferred. This is due to the requirement from the WDL specification that tasks produce functionally equivalent output across runs. When a mutable tag is used, there is a risk that changes to the container will cause different behavior between runs.
- Use of the 'any' container URI (`*`) within an array of container URIs is ambiguous and should be avoided.
- Empty container URI arrays are not disallowed by the specification but are ambiguous and should be avoided.
- An array of container URIs with a single element should be changed to a single string value.

Examples:
```wdl
version 1.2

task say_hello {
    input {
        String name
    }

    command <<<
        echo "Hello, ~{name}!"
    >>>

    # No tag
    requirements {
        container: "ubuntu"
    }
}

task say_goodbye {
    input {
        String name
    }

    command <<<
        echo "Goodbye, ~{name}!"
    >>>

    # Unnecessary array
    requirements {
        container: [
            "ubuntu@sha256:cc925e589b7543b910fea57a240468940003fbfc0515245a495dd0ad8fe7cef1",
        ]
    }
}
```
Use instead:

```wdl
version 1.2

task say_hello {
    input {
        String name
    }

    command <<<
        echo "Hello, ~{name}!"
    >>>

    requirements {
        container: "ubuntu@sha256:cc925e589b7543b910fea57a240468940003fbfc0515245a495dd0ad8fe7cef1"
    }
}

task say_goodbye {
    input {
        String name
    }

    command <<<
        echo "Goodbye, ~{name}!"
    >>>

    requirements {
        container: "ubuntu@sha256:cc925e589b7543b910fea57a240468940003fbfc0515245a495dd0ad8fe7cef1"
    }
}
```
