CI: pin docker images to sha

[bayandin]

This PR pins all docker images to their SHA checksums to prevent unintentional updates, improve build reproducibility, and improve their "cachability".

SHAs are generated using the following command:

docker buildx imagetools inspect --raw ${DOCKER_IMAGE} | openssl dgst -sha256

For example

$ docker buildx imagetools inspect --raw alpine:3.19 | openssl dgst -sha256
SHA2-256(stdin)= e5d0aea7f7d2954678a9a6269ca2d06e06591881161961ea59e974dff3f12377

# And to double check that the value is correct:
$ docker buildx imagetools inspect --raw alpine:3.19@sha256:e5d0aea7f7d2954678a9a6269ca2d06e06591881161961ea59e974dff3f12377 | openssl dgst -sha256
SHA2-256(stdin)= e5d0aea7f7d2954678a9a6269ca2d06e06591881161961ea59e974dff3f12377

All changes are noop. Where possible, I've added a patch version to image tags.

[sharnoff]

Nice, thanks!