Pin all docker image versions (#2881) Remaining unpinned images were in the trusted org and the RBE presubmit config.