Dockerfile: pin hash of debian:stable-slim image

Renovate (and hopefully dependabot) understand this syntax and will
raise PRs when this image is retagged. This should help us stay on top
of package updates and CVEs.

Dockerfile

@@ -1,13 +1,13 @@
 # First stage obtains the list of certificates.
-FROM --platform=$BUILDPLATFORM debian:stable-slim AS build
+FROM --platform=$BUILDPLATFORM debian:stable-slim@sha256:382967fd7c35a0899ca3146b0b73d0791478fba2f71020c7aa8c27e3a4f26672 AS build
 RUN apt-get update && apt-get -y install ca-certificates
 
 # Second stage copies the binaries, configuration and also the
 # certificates from the first stage.
 
 ARG TARGETPLATFORM
 
-FROM --platform=$TARGETPLATFORM debian:stable-slim
+FROM --platform=$TARGETPLATFORM debian:stable-slim@sha256:382967fd7c35a0899ca3146b0b73d0791478fba2f71020c7aa8c27e3a4f26672
 ARG TARGETOS
 ARG TARGETARCH
 ARG HOST_DIST=$TARGETOS-$TARGETARCH