Pin terraform images (#2826)

buildkite/terraform/bazel/pipeline.yml.tpl

diff --git a/buildkite/terraform/bazel/pipeline.yml.tpl b/buildkite/terraform/bazel/pipeline.yml.tpl
index 932e86e..e8f8e99 100644
--- a/buildkite/terraform/bazel/pipeline.yml.tpl
+++ b/buildkite/terraform/bazel/pipeline.yml.tpl
@@ -26,7 +26,7 @@
             - "ANDROID_HOME"
             - "ANDROID_NDK_HOME"
             - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
-          image: "${try(steps.image, "gcr.io/bazel-public/ubuntu2404")}"
+          image: "${try(steps.image, "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c")}"
           network: "host"
           privileged: true
           propagate-environment: true

buildkite/terraform/bazel/pipelines_bazel.tf

diff --git a/buildkite/terraform/bazel/pipelines_bazel.tf b/buildkite/terraform/bazel/pipelines_bazel.tf
index cd686c3..0f44758 100644
--- a/buildkite/terraform/bazel/pipelines_bazel.tf
+++ b/buildkite/terraform/bazel/pipelines_bazel.tf
@@ -891,7 +891,7 @@
       # SKIP_WAIT_FOR_APPROVAL: 1
     },
     steps = {
-      image = "gcr.io/bazel-public/ubuntu2404",
+      image = "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c",
       commands = [
         "curl -sS \"https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)\" -o bazelci.py",
         "curl -sS \"https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazel-central-registry/bcr_presubmit.py?$(date +%s)\" -o bcr_presubmit.py",